diff --git a/.claude/agent-memory/atomic-executor/MEMORY.md b/.claude/agent-memory/atomic-executor/MEMORY.md
index 886714bad..dac422927 100644
--- a/.claude/agent-memory/atomic-executor/MEMORY.md
+++ b/.claude/agent-memory/atomic-executor/MEMORY.md
@@ -33,183 +33,17 @@
 - [Restart re-enters pre-commit census; closed class lists](project_restart_loop_reenters_precommit_census_and_closed_classification_lists.md) (follow restart arrows post-commit and into pass 2; map every census line)
 - [gh/CI-log traps](project_gh_ci_log_and_download_gotchas.md) (createdAt trips pr-author hook; ANSI in Pester log; gh download never overwrites) · [Abbreviated caller facts](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md)
 
+- [MSTest summary absent on failure](project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md) (flaky carve-out keyed on summary never fires; read the trx)
 - [Generic seam over embedded interop = CS1769](project_generic_seam_over_embedded_interop_type_cs1769.md) (Func<Attachment,...> seams compile in UtilitiesCS, fail at every test call site)
 ## Sub-indexes (open when the topic is in scope)
 - [Test isolation + C# coverage](index_test_isolation_and_coverage.md) — vstest/MSTest hangs, flakiness, Cobertura/dotnet-coverage/Koverage
 - [C# nullable + component gotchas](index_csharp_nullable_and_component_gotchas.md) — net481 pragma gates, CS86xx, WebView2, QFC, TimeProvider
 - [pwsh, git and gate mechanics](index_pwsh_git_and_gate_mechanics_misc.md) — pwsh parse traps, PoshQC/Pester, numstat/hunk gates, hooks
 - [Mid-plan commit sanitisation gate](project_midplan_commit_needs_capture_time_sanitisation_gate.md) · [Sanitisation can't sweep its own record](project_sanitisation_task_cannot_sweep_its_own_record.md)
+- [PoshQC analyze: New-* test helpers, comma returns](project_poshqc_analyze_flags_new_verb_test_helpers_and_comma_return.md) · [Rehearsal -X ours drops manifest edits](project_rehearsal_merge_x_ours_drops_adjacent_manifest_edits.md)
 Four sections live in sub-index files to keep this file under its read limit. Open the sub-index when its topic applies:
 - [Build / toolchain environment](index_build_toolchain.md) — SDK/restore bootstrap, CSharpier, analyzers, pwsh/Bash quoting and backslash transport
 - [Test execution, isolation and coverage](index_test_execution_and_coverage.md) — long runs, flaky classes, dotnet-coverage and Cobertura mechanics
 - [Nullable / C# and component gotchas](index_csharp_and_components.md) — pragma gates, CS06xx/CS8xxx, WinForms/WebView2/QFC specifics
 - [Artifact hygiene and misc](index_artifact_hygiene_and_misc.md) — host-path leaks, TRX/msbuild sanitisation, hunk/numstat traps, PoshQC
-- [Mid-plan commit sanitisation gate](project_midplan_commit_needs_capture_time_sanitisation_gate.md) · [Sanitisation can't sweep its own record](project_sanitisation_task_cannot_sweep_its_own_record.md) · [Code commit before format pass](project_code_commit_before_final_format_pass_orphans_rewrites.md)
-- [Blocked Bash drops chained check-off](project_blocked_bash_command_silently_drops_chained_checkoff.md) · [Tool results inject "use Bash"](project_tool_results_inject_bash_read_edit_instruction.md)
-- [CSharpier chain-wrap defeats line gates](project_csharpier_chain_wrap_defeats_singleline_search_gates.md) · [Verify citations with numbered output](feedback_verify_line_citations_with_numbered_output.md)
-- [Plan column widths may include the Markdown indent](project_plan_column_widths_may_include_markdown_indent.md) — re-measure in-file; cite Race.cs chain precedents
-- [Authoring-time counts undercount](project_plan_authoring_time_token_counts_are_undercounts.md) · [Planner/executor see different worktrees](project_planner_and_executor_observe_different_worktrees.md) · [Caller-stated count drifts](project_caller_stated_preflight_count_drifts_before_execution.md)
-- [Extract gate literals, never re-type](project_preflight_gate_literal_extract_from_plan_not_retype.md) · [Tool layer collapses `\`](project_tool_layer_collapses_double_backslash_in_file_content.md)
-- [Self-derived thresholds are blind](project_preflight_selfderived_gate_thresholds_are_blind.md) · [Exact-count gate vs remediation loop](project_exact_count_gate_vs_remediation_loop.md)
-- [Inline-dispatch harness citation](project_inline_dispatch_harness_citation_makes_execution_time_test_vacuous.md) · ["Skip the pointless drain"](project_preflight_drain_scope_optimization_note_makes_test_vacuous.md)
-- [Multi-pattern gates detach qualifiers](project_multipattern_gate_shared_qualifier_detachment.md) · [Zero-hit gate hits doc comments](project_banned_api_zero_hit_gate_hits_doc_comments.md)
-- [Follow-up promotion is unexecutable](project_followup_promotion_task_is_unexecutable_by_executor.md) · [Supersede leaves a routing residual](project_supersede_clause_leaves_hard_routing_residual.md)
-- [Delegation with no dispatch tool](project_plan_delegation_to_typed_engineer_without_dispatch_tool.md)
-- [Check-off fixpoint breaks clean-tree gates](project_plan_checkoff_fixpoint_breaks_terminal_clean_tree_gate.md) · [Tracked agent-memory breaks unscoped gates](project_agent_memory_tracked_breaks_unscoped_git_gates.md)
-- [Merge-base diffs need a commit cadence](project_preflight_mergebase_diff_gates_need_commit_cadence.md) · [BASELINE_SHA conflates the merged base](project_baseline_sha_diff_conflates_merged_base.md)
-- [Epic child branch: inherited commits](project_epic_child_branch_anchored_diff_lists_inherited_commits.md) · [Moving-base two-dot diff inertness](project_preflight_moving_base_two_dot_diff_inertness_test.md)
-- [Inserted tasks force renumbering](project_plan_task_ids_digit_only_forces_renumbering.md) · [Rationale clauses are evidence](project_418_plan_rationale_clauses_are_evidence.md)
-- [Bugfix phase grows the file](project_bugfix_phase_grows_the_file_despite_dead_code_removal.md) · [#418 500-line gate vs plan content](project_418_500line_gate_vs_plan_content.md)
-- [AC check-off + tool-output paths](project_preflight_ac_checkoff_and_tooloutput_paths.md) · [Orchestrator override ≠ an AC](project_orchestrator_override_does_not_satisfy_an_ac.md)
-- [Output Summary breaks its count gate](project_artifact_output_summary_breaks_its_own_exact_count_gate.md) · [Scope gate can't list later artifacts](project_scope_gate_cannot_list_artifacts_written_after_it.md)
-- [Zero gate on a sibling-owned assembly](project_preflight_absolute_zero_gate_on_sibling_owned_assembly.md) · [Directory-scoped format breaks ownership](project_directory_scoped_format_breaks_ownership_gates.md)
-- [#207 Hook() breaks AppEventsTests](project_207_hook_redesign_breaks_appeventstests.md) · [C2 capacity budget drifts](project_c2_capacity_budget_drifts_mid_plan.md)
-- [AppGlobalsTests at the 500-line ceiling](project_appglobalstests_at_500_line_ceiling.md) · [#376 scope-expansion layers](project_376_capstone_scope_expansion_layers.md)
-- [Swordfish F5 misclassification](project_swordfish_f5_test_misclassification.md) · [Confirmatory preflight: proportionate bar](feedback_confirmatory_preflight_proportionate_bar.md)
-- [Four recurring C# defect classes](project_preflight_recurring_csharp_plan_defect_classes.md) · [msbuild-log grep hits the csc line](project_msbuild_log_token_search_matches_csc_command_line.md)
-- [Epic base invalidates line counts](project_epic_integration_base_invalidates_research_line_counts.md) · ["Make the citation exist" spreads false facts](project_preflight_citation_match_propagates_false_fact.md)
-- [Check-off cites a LATER artifact](project_preflight_checkoff_cites_later_task_artifact.md) · [Pre-edit gate cites the post-edit table](project_preedit_gate_cites_postedit_replacement_table.md)
-- [Conjunctive criteria break one-artifact citation](project_preflight_conjunctive_criterion_citation_gap.md) · [Delta gate cites an unrecorded baseline count](project_gate_cites_a_baseline_count_the_baseline_task_never_records.md)
-- [Blanket assertions + forward deps](project_preflight_blanket_assertion_and_forward_dependency.md) · [pwsh -Command quoting boundary](project_pwsh_command_quoting_boundary.md)
-- [Locators stale after a doc edit](project_plan_line_locators_stale_after_doc_edit.md) · [csproj ranges shift during execution](project_plan_csproj_line_ranges_shift_during_execution.md)
-- [Probe C# shapes with csc](project_preflight_csc_probe_for_mandated_csharp_shapes.md) · [Evidence fields need a token scan](project_preflight_evidence_field_token_scan.md)
-- [Literals inherit research arithmetic](project_plan_literal_assertions_inherit_research_arithmetic.md) · [Fix tasks inherit the round's rules](project_preflight_fix_tasks_inherit_decomposition_rules.md)
-- [Conditional split = three tasks](project_conditional_split_three_task_shape.md) · [Round-over-round plan diff unavailable](project_preflight_round_over_round_diff_unavailable.md)
-- [Flaky carve-out added to one task only](project_flaky_test_carveout_added_to_one_task_only.md) · [Revision bullet negates an earlier clause](project_revision_bullet_negates_earlier_clause_left_standing.md)
-- [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md) · [Hygiene scan: comma precedence + d:\s hits](project_hygiene_pattern_array_comma_precedence_and_regex_token_hits.md)
-- [Loop re-runs vs one-artifact glob + hash anchors](project_loop_iteration_vs_single_artifact_glob_and_hash_anchor.md)
-- [Route-keyed branches miss derived-flag cases](project_outcome_branch_sets_keyed_on_route_miss_derived_flag_cases.md) · [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md)
-
-## Build / toolchain environment
-- [pwsh/git/gh gotchas](project_pwsh_git_gh_cli_gotchas.md) · [Build/Test env](project_build_test_env.md) · [VS18 paths](project_vs18_build_toolchain_paths.md) · [SDK + nullable Rebuild](project_repo_sdk_and_nullable_rebuild.md)
-- [Fresh worktree restore](project_fresh_worktree_needs_sdk_and_packages_config_restore.md) · [Start-Process quoting](project_startprocess_arglist_array_strips_quoting.md) · [Relative pwsh paths](project_relative_path_in_pwsh_dotnet_io_hits_wrong_worktree.md)
-- [QuickFiler.Test hang](project_quickfiler_test_coverage_hang_and_build_flags.md) · [$CoverageOutput clobber](project_dotsourcing_invoke_mstest_clobbers_coverageoutput_param.md) · [TestCaseFilter OR](project_vstest_testcasefilter_or_operator_and_env_setup.md)
-- [File vs partial class](project_test_file_name_vs_partial_class_name.md) · [HintPath skew](project_analyzer_hintpath_skew_breaks_all_four_gates.md) · [Analyzer skew fresh](project_analyzer_version_skew_fresh_worktree.md) · [SecurityCodeScan](project_securitycodescan_roslyn56_incompat.md)
-- [VSTO runtime](project_missing_vsto_runtime_breaks_baseline_gates.md) · [MSB3277](project_new_sln_member_surfaces_msb3277_pin_divergence.md) · [No transitive refs](project_legacy_csproj_no_transitive_compile_refs.md) · [CRLF](project_sln_csproj_edit_crlf_preserve.md)
-- [Incremental vacuous](project_incremental_build_vacuous_baseline.md) · [Nullable /t:Build](project_nullable_build_gate_is_vacuous_incremental.md) · [Designer.cs skip](project_csharpier_skips_designer_cs_by_filename.md) · [*.log ignore](project_gitignore_star_log_blocks_committed_msbuild_log_evidence.md)
-- [pipe-files](project_csharpier_pipefiles_nonenforcing_gate.md) · [Count idioms](project_count_idiom_pitfalls_csharpier_and_measureobject.md) · [New .cs restart](project_new_cs_files_guarantee_a_format_loop_restart.md) · [PS BOM](powershell-bom-required.md)
-- [BOM grep ^](project_bom_grep_anchor_false_negative.md) · [StrictMode XML attr](project_pester_strictmode_xml_attribute_property_access.md) · [Pester helper BeforeAll](project_pester5_helper_function_must_live_in_beforeall.md)
-- [-NoExecute premise](project_noexecute_early_return_premise_hides_reachable_entry_point_tests.md) · [poshqc test no verdict](project_poshqc_pester_mcp_exit_minus1.md) · [analyze exit 1](project_poshqc_analyze_exit1_on_warning.md)
-- [Pester 5 result shape](project_pester5_result_shape_container_tests_and_ci_codecoverage.md) · [Heredoc \\](project_bash_heredoc_collapses_doubled_backslashes.md) · [Unquoted backslash](project_unquoted_backslash_in_bash_arg_silently_redirects_output.md)
-- [Doubled backslash](project_doubled_backslash_dedoubles_bash_to_native_exe.md) · [Recursive delete](project_recursive_delete_idioms_blocked_use_dotnet_api.md) · [pwsh -Command quoting](project_pwsh_command_quoting_from_bash.md)
-- [pwsh -File list](project_pwsh_file_array_param_from_bash.md) · [Compile-red refs](project_compile_red_needs_body_level_references.md) · [Splat gates](project_cross_task_shell_variable_splat_gate.md)
-- [<TS> collision](project_evidence_timestamp_collision_clobbers_artifacts.md) · [Floating <ts>](project_shared_evidence_artifact_floating_ts.md)
-
-## Test execution & isolation
-- [Detached long runs](project_long_runs_need_detached_process.md) · [Mock GUI](feedback_tests_must_mock_gui_no_visible_window.md) · [Suite hangs](project_full_suite_run_hangs_while_earlier_runs_idle.md)
-- [PumpHost flaky](project_winformspumphost_tests_load_flaky.md) · [/InIsolation](project_vstest_isolation_and_filepathhelper_serialization.md)
-- [Timed-out runner](project_timedout_mstest_leaves_detached_runner.md) · [Sibling tooling](project_sibling_worktree_shared_tooling_hazard.md) · [Concurrent executor](project_concurrent_executor_same_worktree.md)
-- [coverage deadlock](project_concurrent_dotnet_coverage_deadlock_and_doccomment_retention_gate.md) · [UtilitiesCS parallel](project_utilitiescs_test_parallelism_flakiness.md) · [DoNotParallelize](project_mstest_donotparallelize_overlaps_parallel_bucket.md)
-- [MemoryAppender per TYPE](project_log4net_memoryappender_shared_per_type_across_parallel_classes.md) · [Dispatcher swap race](project_uithread_dispatcher_static_swap_race.md) · [DataCollector default](project_runsettings_datacollector_default_enabled.md)
-- [Deedle/FSharp](project_dotnet_coverage_deedle_fsharp_instrumentation.md) · [DispatcherDelay hangs](project_dispatcherdelay_hangs_unit_tests.md) · [ConfigController STA](project_configcontroller_sta_pump_deadlock.md)
-
-## Coverage measurement
-- C# coverage mechanics (Cobertura, Koverage, denominators): see the sub-index at the top
-- [Package-rate not-lower gate vs variance](project_package_rate_not_lower_gate_trips_on_unrelated_file_variance.md) — unrelated-file variance fails package/repo not-lower gates on small-delta items
-- [Cobertura hits are binary](project_dotnet_coverage_cobertura_hits_are_binary.md) — dotnet-coverage hits are 0/1; "guard hits > record hits" can never hold; use the guard line's condition-coverage
-
-## Nullable / C# language
-- [Pragma gate](project_nullable_pragma_gate_mechanics.md) · [net481 pragma](project_nullable_pragma_gate_net481_mechanics.md) · [Epic pragma](project_nullable_epic_pragma_gate_and_analyzer_restore.md)
-- [CLAUDE.md != CI](project_507_nullconditional_return_triggers_cs8603_under_genuine_nullable_check.md) · [Annotations](project_nullable_remediation_annotation_patterns.md) · [CS8632](project_nullable_annotation_cs8632_scoping.md) · [CS8714](project_nullable_cs8714_not_on_net481.md)
-- [CS0518](project_record_struct_isexternalinit_netfx.md) · Closed issues and component gotchas: see the sub-index at the top
-
-## Artifact hygiene & misc mechanics
-- [No host paths](../_shared_no_absolute_host_paths.md) · [Never predict](feedback_never_predict_an_observation_into_an_artifact.md) · [<TS> drift](project_evidence_timestamp_labels_drift_ahead_of_write_time.md) · [Probe literal](project_selftest_probe_literal_trips_the_next_sweep_pass.md)
-- [TRX case](project_trx_sanitisation_must_be_case_insensitive.md) · [TRX/msbuild sanitise](project_vstest_trx_evidence_needs_sanitisation_task.md) · [msbuild 2 roots](project_msbuild_log_has_two_absolute_path_leak_classes.md) · [Deploy_ leaks](project_mstest_deploy_dir_leaks_tokens_on_failing_runs.md)
-- [Two .coverage](project_vstest_emits_two_coverage_files_per_run.md) · [No Failed line](project_vstest_success_run_prints_no_failed_or_skipped_line.md) · [Scratch .ps1](project_powershell_scratch_script_budget_hook_blocks_helpers.md) · [Mandated .ps1](project_plan_mandated_ps1_helpers_collide_with_budget_cap_and_frozen_porcelain_gate.md)
-- [2nd pass fields](project_appending_a_second_pass_must_not_qualify_schema_fields.md) · [env -C](project_bash_cwd_resets_use_env_dash_c.md) · [global.json cwd](project_dotnet_global_json_cwd_search_vs_bash_discipline.md) · [pwsh -File root](project_pwsh_file_starts_in_session_root_needs_workingdirectory.md)
-- [pwsh stdin REPL](project_pwsh_stdin_repl_mode_and_nonascii_mangling.md) · [Isolation guard](project_worktree_isolation_guard_refuses_pwsh_from_bash.md) · [Branch gate fix](project_changed_line_coverage_branch_gate_invalidated_by_the_fix.md)
-- [ExpectedExitCode](project_expectedexitcode_declared_from_baseline_not_observed_run.md) · [Blank before comment](project_csharpier_requires_blank_line_before_comment_breaking_numstat_bounds.md) · [this-lambdas](project_excludefromcodecoverage_misses_this_capturing_lambdas.md)
-- [Koverage separators](project_koverage_reporoot_needs_native_separators.md) · [FakeTimeProvider zero](project_faketimeprovider_zero_duetime_fires_at_creation.md) · [Reflective read](project_reflective_property_read_escapes_member_expression_grep.md)
-- [Preparation mode](project_preparation_mode_flips_anchored_diff_gate_membership.md) · [git grep -c oracle](project_git_grep_c_empty_is_the_allowlisted_line_count_oracle.md) · [Fallback orphans](project_contingency_fallback_orphans_downstream_hardcoded_paths.md)
-- [Per-comment literal](project_stale_citation_gate_literal_must_match_the_comments_legitimate_citations.md) · [TimeoutAfter race](project_timeoutafter_iscompleted_shortcircuit_loses_to_taskrun_race.md) · [Cobertura class nodes](project_cobertura_filename_maps_to_several_class_nodes.md)
-- [Logger double-counts](project_msbuild_filelogger_double_counts_each_warning.md) · [Reconciliation merge](project_orchestrator_reconciliation_merge_tracks_feature_docs.md) · [Seam sentences](project_preflight_seam_sentences_outlive_a_removed_member.md)
-- [Compile items](project_explicit_compile_items_decide_membership_not_file_presence.md) · [git add -N](project_intent_to_add_span_defeats_do_not_stage_invariant.md) · [Hunk header](project_git_hunk_header_literal_slides_past_blank_line.md)
-- [Budget hook out-of-root](project_batch_budget_hook_discards_out_of_root_powershell_writes.md) · [BOM .cs numstat](project_bom_bearing_cs_files_and_prerestore_numstat_head_gates.md) · [CLAUDE.md per worktree](project_claude_md_differs_between_worktrees_read_execution_copy.md)
-- [Token kill own shells](project_commandline_match_on_results_dir_token_kills_own_tool_shells.md) · [No .vsto](project_commandline_rebuild_omits_vsto_manifests_addin_cannot_load.md) · [git show ibm437](project_conservation_gate_git_show_decodes_ibm437_and_keeps_bom.md)
-- [$LASTEXITCODE StrictMode](project_coverage_helpers_dotsource_strictmode_lastexitcode_throws.md) · [Exactly-once literal](project_exactly_once_literal_clause_conflicts_with_pattern_containment_clause.md) · [Sibling test file](project_fixed_run_path_coverage_gate_blind_to_sibling_test_file.md)
-- [Promotion rename](project_footprint_inventory_clause_omits_inherited_promotion_rename.md) · [AC count claim](project_handoff_stated_ac_count_contradicts_the_ac_source_file.md) · [Kill by PID](project_killing_a_build_lock_waiter_by_script_name_hits_every_sibling.md)
-- [Malformed payload](project_malformed_pwsh_payload_surfaces_as_unrelated_hook_block.md) · [Blank line binding](project_mandatory_string_array_param_rejects_blank_line_turning_red_into_binding_error.md) · [Whole-file hunk](project_mergebase_diff_over_branch_created_file_is_whole_file_hunk.md)
-- [Mid-plan commit spans](project_midplan_commit_breaks_deletion_staging_and_porcelain_spans.md) · [Minute timestamps](project_minute_resolution_timestamp_cannot_be_strictly_increasing.md) · [/m N> prefix](project_msbuild_parallel_log_node_prefix_defeats_anchored_target_counts.md)
-- [Import-Module -Force](project_nested_import_module_force_unloads_session_wide.md) · [Hold-commits](project_parent_orchestrator_hold_commits_your_branch_midrun.md) · [Pester NotRun](project_pester_filtered_total_counts_notrun.md)
-- [Auto-property guard](project_plan_mandated_autoproperty_with_setter_guard_is_not_expressible.md) · [PoshQC format rules](project_poshqc_format_rewrites_differ_from_invoke_formatter_defaults.md) · [PoshQC BOM/CRLF](project_poshqc_format_strips_bom_and_crlf_only_when_it_rewrites.md)
-- [PS double-quote \\](project_powershell_double_quoted_backslash_defeats_msbuild_nonvacuity_grep.md) · [PSSA traps](project_psscriptanalyzer_traps_in_new_powershell_modules.md) · [$args param](project_pwsh_function_param_named_args_makes_msbuild_gate_vacuous.md)
-- [Nested quotes $( )](project_pwsh_nested_quotes_in_subexpression_fail_to_parse.md) · [$Log/$log](project_pwsh_param_name_case_collision_flattens_log_array.md) · [Reference rewrite](project_reference_version_rewrite_when_assemblyversion_omitted.md)
-- [Numstat elides](project_replacement_span_numstat_elides_identical_boundary_lines.md) · [Finding description](project_review_finding_line_number_right_description_wrong.md) · [Splatting lines](project_splatting_is_the_line_budget_lever_for_ceiling_bound_test_files.md)
-- [-WhatIf module scope](project_whatif_does_not_reach_module_session_state.md) · [Removal hook: git + "remove"](project_worktree_removal_hooks_match_git_plus_remove_substring.md)
-- [FluentAssertions truncates string diffs](project_fluentassertions_truncates_string_diff_breaks_message_substring_gates.md) — "…59Sandbox\origin": full-path MESSAGE substring gates cannot match
-- [Cited-tree gate vs main; span enumeration](project_preflight_cited_tree_gate_and_span_enumeration.md) — intersect cited paths with the files main changed; every stop string needs a task that detects it
-- [Field gate `Contains("EXIT_CODE:")` matches FORMAT_EXIT_CODE:](project_schema_field_contains_check_matches_prefixed_labels.md) — anchor the field match to the line start
-- [Worktree-gate hook: git + "remove" in any identifier](project_worktree_removal_hook_matches_git_plus_remove_in_variable_names.md) — read-only payloads with `$removed` halt the run; flag at preflight
-## Component-specific gotchas
-- [WebView2 EndInit creates child handles](project_webview2_endinit_creates_handles.md) · [#349 breadcrumb WebView2](project_349_breadcrumb_webview2_gotchas.md)
-- QFC #227: [cycle-4 ToggleFocus](project_qfc227_cycle4_toggle_focus_genuine_test_gotchas.md) · [cycle-3 seam](project_theme_folderpredictor_seam_retrofit_gotchas.md)
-- [ObjectListView headless selection](project_objectlistview_treelistview_headless_selection.md) · [BackgroundWorker async-void race](project_qfc_backgroundworker_async_void_race.md)
-- [QfcItemController needs SaveParameters](project_qfcitemcontroller_pump_harness_needs_saveparameters.md) · [TaskController (#297)](project_taskvisualization_taskcontroller_test_gotchas.md)
-- [ProjectEntry setter raw MessageBox](project_projectentry_setter_raw_messagebox.md) · [IApplicationGlobals member forces implementers](project_iapplicationglobals_member_forces_implementers.md)
-- [TimeProvider seam gotchas](project_timeprovider_seam_gotchas.md) · [GetOrLoad discards setter injection](project_initializer_getorload_discards_injection_when_dependency_null.md)
-- [ScoDictionaryNew needs TryAdd](project_scodictionarynew_tryadd_not_add.md) · [Equal(params) has no because](project_fluentassertions_equal_params_no_because.md) · [BeEmpty names only the first item](project_fluentassertions_beempty_names_only_first_item.md)
-## Artifact hygiene
-- [Never embed absolute host paths](../_shared_no_absolute_host_paths.md) · [Never predict an observation](feedback_never_predict_an_observation_into_an_artifact.md)
-- [<TS> drifts ahead of write time](project_evidence_timestamp_labels_drift_ahead_of_write_time.md) · [Probe literal trips the NEXT sweep](project_selftest_probe_literal_trips_the_next_sweep_pass.md)
-- [TRX sanitisation is case-insensitive](project_trx_sanitisation_must_be_case_insensitive.md) · [TRX/msbuild need a sanitisation micro-action](project_vstest_trx_evidence_needs_sanitisation_task.md)
-- [MSBuild logs leak TWO roots](project_msbuild_log_has_two_absolute_path_leak_classes.md) · [Deploy_ leaks tokens on FAILING runs](project_mstest_deploy_dir_leaks_tokens_on_failing_runs.md)
-- [vstest leaves TWO .coverage files](project_vstest_emits_two_coverage_files_per_run.md) · [Green run prints no Failed/Skipped line](project_vstest_success_run_prints_no_failed_or_skipped_line.md)
-- [PS budget hook blocks scratch .ps1](project_powershell_scratch_script_budget_hook_blocks_helpers.md) · [Plan-mandated .ps1 + frozen porcelain gate](project_plan_mandated_ps1_helpers_collide_with_budget_cap_and_frozen_porcelain_gate.md)
-- [2nd pass must not qualify schema fields](project_appending_a_second_pass_must_not_qualify_schema_fields.md) · [Bash resets cwd; use `env -C`](project_bash_cwd_resets_use_env_dash_c.md)
-- [global.json cwd-search vs no-cd discipline](project_dotnet_global_json_cwd_search_vs_bash_discipline.md) · [pwsh -File starts in the SESSION root](project_pwsh_file_starts_in_session_root_needs_workingdirectory.md)
-- [pwsh stdin is a REPL](project_pwsh_stdin_repl_mode_and_nonascii_mangling.md) · [Isolation guard refuses pwsh from Bash](project_worktree_isolation_guard_refuses_pwsh_from_bash.md)
-- [ExpectedExitCode keyed off the baseline](project_expectedexitcode_declared_from_baseline_not_observed_run.md) · [Koverage -RepoRoot needs native separators](project_koverage_reporoot_needs_native_separators.md)
-- [CSharpier forces a blank line before a comment](project_csharpier_requires_blank_line_before_comment_breaking_numstat_bounds.md) · [ExcludeFromCodeCoverage misses `this`-capturing lambdas](project_excludefromcodecoverage_misses_this_capturing_lambdas.md)
-- [Koverage -RepoRoot needs native separators](project_koverage_reporoot_needs_native_separators.md) · [FakeTimeProvider zero due time fires at creation](project_faketimeprovider_zero_duetime_fires_at_creation.md)
-- [Reflective property read escapes a member grep](project_reflective_property_read_escapes_member_expression_grep.md) · [Preparation mode flips anchored-diff membership](project_preparation_mode_flips_anchored_diff_gate_membership.md)
-- [git grep -c with an empty pattern is the line-count oracle](project_git_grep_c_empty_is_the_allowlisted_line_count_oracle.md) - Read renders a phantom trailing line
-- [Contingency fallback orphans downstream paths](project_contingency_fallback_orphans_downstream_hardcoded_paths.md) · [Stale-citation gate literal is per-comment](project_stale_citation_gate_literal_must_match_the_comments_legitimate_citations.md)
-- [TimeoutAfter IsCompleted loses to the Task.Run race](project_timeoutafter_iscompleted_shortcircuit_loses_to_taskrun_race.md) · [One Cobertura filename, several class nodes](project_cobertura_filename_maps_to_several_class_nodes.md)
-- [msbuild file logger double-counts warnings](project_msbuild_filelogger_double_counts_each_warning.md) · [Reconciliation merge already tracks the feature docs](project_orchestrator_reconciliation_merge_tracks_feature_docs.md)
-- [Seam sentences outlive a removed member](project_preflight_seam_sentences_outlive_a_removed_member.md) — after a decision removes an interface member, grep the spec for "Moq double of the .* interface"/"injectable"; keyword sweeps miss them
-- [Explicit Compile items decide membership, not file presence](project_explicit_compile_items_decide_membership_not_file_presence.md) — a grep hit can be uncompiled
-- [`git add -N -- .` defeats a "do not stage X" invariant](project_intent_to_add_span_defeats_do_not_stage_invariant.md) — it reads as diff plumbing, so a staging audit skips it
-- [Hunk-header literal slides past a blank line](project_git_hunk_header_literal_slides_past_blank_line.md) — measured; assert numstat deleted=0, never `@@ -N,0 +M,`
-- [Batch-budget hook discards out-of-root .ps1 writes](project_batch_budget_hook_discards_out_of_root_powershell_writes.md) — hook roots at session worktree; plan gates reading its state become unsatisfiable
-- [BOM-bearing .cs files + pre-restore numstat gates](project_bom_bearing_cs_files_and_prerestore_numstat_head_gates.md)
-- [CLAUDE.md differs per worktree; read the execution copy](project_claude_md_differs_between_worktrees_read_execution_copy.md)
-- [CommandLine token kill hits own bash/pwsh shells](project_commandline_match_on_results_dir_token_kills_own_tool_shells.md)
-- [CLI Rebuild omits .vsto/.manifest](project_commandline_rebuild_omits_vsto_manifests_addin_cannot_load.md)
-- [git show in pwsh decodes ibm437 + keeps BOM](project_conservation_gate_git_show_decodes_ibm437_and_keeps_bom.md)
-- [Dot-sourced coverage helpers: StrictMode $LASTEXITCODE throws](project_coverage_helpers_dotsource_strictmode_lastexitcode_throws.md)
-- [Exactly-once literal vs pattern-containment clause](project_exactly_once_literal_clause_conflicts_with_pattern_containment_clause.md)
-- [Fixed run-path coverage gate blind to sibling test file](project_fixed_run_path_coverage_gate_blind_to_sibling_test_file.md)
-- [Inventory clause omits inherited promotion rename](project_footprint_inventory_clause_omits_inherited_promotion_rename.md)
-- [Handoff AC count is a claim; measure the AC file](project_handoff_stated_ac_count_contradicts_the_ac_source_file.md)
-- [Kill build-lock waiter by PID, not script name](project_killing_a_build_lock_waiter_by_script_name_hits_every_sibling.md)
-- [Malformed pwsh payload surfaces as unrelated hook block](project_malformed_pwsh_payload_surfaces_as_unrelated_hook_block.md)
-- [Mandatory [string[]] rejects a blank line](project_mandatory_string_array_param_rejects_blank_line_turning_red_into_binding_error.md)
-- [Merge-base diff over branch-created file = one whole-file hunk](project_mergebase_diff_over_branch_created_file_is_whole_file_hunk.md)
-- [Mid-plan commit breaks deletion staging/porcelain spans](project_midplan_commit_breaks_deletion_staging_and_porcelain_spans.md)
-- [Minute-resolution timestamps can't be strictly increasing](project_minute_resolution_timestamp_cannot_be_strictly_increasing.md)
-- [/m "N>" prefix zeroes anchored target counts](project_msbuild_parallel_log_node_prefix_defeats_anchored_target_counts.md)
-- [Nested Import-Module -Force unloads session-wide](project_nested_import_module_force_unloads_session_wide.md)
-- [Parent orchestrator hold-commits your branch mid-run](project_parent_orchestrator_hold_commits_your_branch_midrun.md)
-- [Pester TotalCount includes filtered NotRun](project_pester_filtered_total_counts_notrun.md)
-- [Auto-property with setter guard is not expressible](project_plan_mandated_autoproperty_with_setter_guard_is_not_expressible.md)
-- [PoshQC format != Invoke-Formatter defaults](project_poshqc_format_rewrites_differ_from_invoke_formatter_defaults.md)
-- [PoshQC strips BOM/CRLF only on rewrite](project_poshqc_format_strips_bom_and_crlf_only_when_it_rewrites.md)
-- [PS double quotes keep both backslashes](project_powershell_double_quoted_backslash_defeats_msbuild_nonvacuity_grep.md)
-- [4 PSScriptAnalyzer traps in new modules](project_psscriptanalyzer_traps_in_new_powershell_modules.md)
-- [Param named $args makes msbuild gate vacuous](project_pwsh_function_param_named_args_makes_msbuild_gate_vacuous.md)
-- [Nested quotes in "$( )" fail to parse](project_pwsh_nested_quotes_in_subexpression_fail_to_parse.md)
-- [$Log/$log case collision flattens array](project_pwsh_param_name_case_collision_flattens_log_array.md)
-- [pwsh @(a + x, b + y) is ONE string](project_pwsh_array_literal_comma_binds_before_plus.md)
-- [Pre-impl gate reads the SESSION-root checkpoint](project_preimplementation_gate_reads_session_root_checkpoint_not_item_worktree.md)
-- [Invoke-VersionReconciliation rewrites Reference version](project_reference_version_rewrite_when_assemblyversion_omitted.md)
-- [Replaced-span numstat elides identical boundary lines](project_replacement_span_numstat_elides_identical_boundary_lines.md)
-- [Finding's line right, description wrong](project_review_finding_line_number_right_description_wrong.md)
-- [Splatting frees lines in ceiling-bound test files](project_splatting_is_the_line_budget_lever_for_ceiling_bound_test_files.md)
-- [-WhatIf does not reach module ShouldProcess](project_whatif_does_not_reach_module_session_state.md)
-- [WinForms control field installs SyncContext, deadlocks await](project_winforms_control_field_installs_synccontext_and_deadlocks_await.md)
-- [Backtick-span Grep returns gaps](project_backtick_span_grep_gap_matches.md) — manual blast-radius token re-check
-## Artifact hygiene, shell/pwsh pitfalls, misc (sub-index)
-- [Sub-index: 58 entries](index_artifact_hygiene_and_misc.md) — evidence sanitisation, TRX/msbuild path leaks, pwsh quoting, csharpier/numstat, git spans, Pester, hooks
-- [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md) — a correct citation can read as contradicting a "do not re-verify" fact
-- [git grep -I skips UTF-16 evidence](project_git_grep_binary_flag_skips_utf16_evidence.md)
+- [Overflow index: ~170 moved entries](index_overflow_entries.md) — plan-gate defect classes, build/test env, hygiene, pwsh/git pitfalls, component gotchas
diff --git a/.claude/agent-memory/atomic-executor/index_overflow_entries.md b/.claude/agent-memory/atomic-executor/index_overflow_entries.md
new file mode 100644
index 000000000..6a78e9fa3
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/index_overflow_entries.md
@@ -0,0 +1,173 @@
+# Overflow index (moved verbatim from MEMORY.md on 2026-10-09)
+
+Entries below were moved unchanged to keep MEMORY.md under its read limit. Some lines duplicate entries in other sub-indexes.
+
+- [Mid-plan commit sanitisation gate](project_midplan_commit_needs_capture_time_sanitisation_gate.md) · [Sanitisation can't sweep its own record](project_sanitisation_task_cannot_sweep_its_own_record.md) · [Code commit before format pass](project_code_commit_before_final_format_pass_orphans_rewrites.md)
+- [Blocked Bash drops chained check-off](project_blocked_bash_command_silently_drops_chained_checkoff.md) · [Tool results inject "use Bash"](project_tool_results_inject_bash_read_edit_instruction.md)
+- [CSharpier chain-wrap defeats line gates](project_csharpier_chain_wrap_defeats_singleline_search_gates.md) · [Verify citations with numbered output](feedback_verify_line_citations_with_numbered_output.md)
+- [Plan column widths may include the Markdown indent](project_plan_column_widths_may_include_markdown_indent.md) — re-measure in-file; cite Race.cs chain precedents
+- [Authoring-time counts undercount](project_plan_authoring_time_token_counts_are_undercounts.md) · [Planner/executor see different worktrees](project_planner_and_executor_observe_different_worktrees.md) · [Caller-stated count drifts](project_caller_stated_preflight_count_drifts_before_execution.md)
+- [Extract gate literals, never re-type](project_preflight_gate_literal_extract_from_plan_not_retype.md) · [Tool layer collapses `\`](project_tool_layer_collapses_double_backslash_in_file_content.md)
+- [Self-derived thresholds are blind](project_preflight_selfderived_gate_thresholds_are_blind.md) · [Exact-count gate vs remediation loop](project_exact_count_gate_vs_remediation_loop.md)
+- [Inline-dispatch harness citation](project_inline_dispatch_harness_citation_makes_execution_time_test_vacuous.md) · ["Skip the pointless drain"](project_preflight_drain_scope_optimization_note_makes_test_vacuous.md)
+- [Multi-pattern gates detach qualifiers](project_multipattern_gate_shared_qualifier_detachment.md) · [Zero-hit gate hits doc comments](project_banned_api_zero_hit_gate_hits_doc_comments.md)
+- [Follow-up promotion is unexecutable](project_followup_promotion_task_is_unexecutable_by_executor.md) · [Supersede leaves a routing residual](project_supersede_clause_leaves_hard_routing_residual.md)
+- [Delegation with no dispatch tool](project_plan_delegation_to_typed_engineer_without_dispatch_tool.md)
+- [Check-off fixpoint breaks clean-tree gates](project_plan_checkoff_fixpoint_breaks_terminal_clean_tree_gate.md) · [Tracked agent-memory breaks unscoped gates](project_agent_memory_tracked_breaks_unscoped_git_gates.md)
+- [Merge-base diffs need a commit cadence](project_preflight_mergebase_diff_gates_need_commit_cadence.md) · [BASELINE_SHA conflates the merged base](project_baseline_sha_diff_conflates_merged_base.md)
+- [Epic child branch: inherited commits](project_epic_child_branch_anchored_diff_lists_inherited_commits.md) · [Moving-base two-dot diff inertness](project_preflight_moving_base_two_dot_diff_inertness_test.md)
+- [Inserted tasks force renumbering](project_plan_task_ids_digit_only_forces_renumbering.md) · [Rationale clauses are evidence](project_418_plan_rationale_clauses_are_evidence.md)
+- [Bugfix phase grows the file](project_bugfix_phase_grows_the_file_despite_dead_code_removal.md) · [#418 500-line gate vs plan content](project_418_500line_gate_vs_plan_content.md)
+- [AC check-off + tool-output paths](project_preflight_ac_checkoff_and_tooloutput_paths.md) · [Orchestrator override ≠ an AC](project_orchestrator_override_does_not_satisfy_an_ac.md)
+- [Output Summary breaks its count gate](project_artifact_output_summary_breaks_its_own_exact_count_gate.md) · [Scope gate can't list later artifacts](project_scope_gate_cannot_list_artifacts_written_after_it.md)
+- [Zero gate on a sibling-owned assembly](project_preflight_absolute_zero_gate_on_sibling_owned_assembly.md) · [Directory-scoped format breaks ownership](project_directory_scoped_format_breaks_ownership_gates.md)
+- [#207 Hook() breaks AppEventsTests](project_207_hook_redesign_breaks_appeventstests.md) · [C2 capacity budget drifts](project_c2_capacity_budget_drifts_mid_plan.md)
+- [AppGlobalsTests at the 500-line ceiling](project_appglobalstests_at_500_line_ceiling.md) · [#376 scope-expansion layers](project_376_capstone_scope_expansion_layers.md)
+- [Swordfish F5 misclassification](project_swordfish_f5_test_misclassification.md) · [Confirmatory preflight: proportionate bar](feedback_confirmatory_preflight_proportionate_bar.md)
+- [Four recurring C# defect classes](project_preflight_recurring_csharp_plan_defect_classes.md) · [msbuild-log grep hits the csc line](project_msbuild_log_token_search_matches_csc_command_line.md)
+- [Epic base invalidates line counts](project_epic_integration_base_invalidates_research_line_counts.md) · ["Make the citation exist" spreads false facts](project_preflight_citation_match_propagates_false_fact.md)
+- [Check-off cites a LATER artifact](project_preflight_checkoff_cites_later_task_artifact.md) · [Pre-edit gate cites the post-edit table](project_preedit_gate_cites_postedit_replacement_table.md)
+- [Conjunctive criteria break one-artifact citation](project_preflight_conjunctive_criterion_citation_gap.md) · [Delta gate cites an unrecorded baseline count](project_gate_cites_a_baseline_count_the_baseline_task_never_records.md)
+- [Blanket assertions + forward deps](project_preflight_blanket_assertion_and_forward_dependency.md) · [pwsh -Command quoting boundary](project_pwsh_command_quoting_boundary.md)
+- [Locators stale after a doc edit](project_plan_line_locators_stale_after_doc_edit.md) · [csproj ranges shift during execution](project_plan_csproj_line_ranges_shift_during_execution.md)
+- [Probe C# shapes with csc](project_preflight_csc_probe_for_mandated_csharp_shapes.md) · [Evidence fields need a token scan](project_preflight_evidence_field_token_scan.md)
+- [Literals inherit research arithmetic](project_plan_literal_assertions_inherit_research_arithmetic.md) · [Fix tasks inherit the round's rules](project_preflight_fix_tasks_inherit_decomposition_rules.md)
+- [Conditional split = three tasks](project_conditional_split_three_task_shape.md) · [Round-over-round plan diff unavailable](project_preflight_round_over_round_diff_unavailable.md)
+- [Flaky carve-out added to one task only](project_flaky_test_carveout_added_to_one_task_only.md) · [Revision bullet negates an earlier clause](project_revision_bullet_negates_earlier_clause_left_standing.md)
+- [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md) · [Hygiene scan: comma precedence + d:\s hits](project_hygiene_pattern_array_comma_precedence_and_regex_token_hits.md)
+- [Loop re-runs vs one-artifact glob + hash anchors](project_loop_iteration_vs_single_artifact_glob_and_hash_anchor.md)
+- [Route-keyed branches miss derived-flag cases](project_outcome_branch_sets_keyed_on_route_miss_derived_flag_cases.md) · [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md)
+
+## Build / toolchain environment
+- [pwsh/git/gh gotchas](project_pwsh_git_gh_cli_gotchas.md) · [Build/Test env](project_build_test_env.md) · [VS18 paths](project_vs18_build_toolchain_paths.md) · [SDK + nullable Rebuild](project_repo_sdk_and_nullable_rebuild.md)
+- [Fresh worktree restore](project_fresh_worktree_needs_sdk_and_packages_config_restore.md) · [Start-Process quoting](project_startprocess_arglist_array_strips_quoting.md) · [Relative pwsh paths](project_relative_path_in_pwsh_dotnet_io_hits_wrong_worktree.md)
+- [QuickFiler.Test hang](project_quickfiler_test_coverage_hang_and_build_flags.md) · [$CoverageOutput clobber](project_dotsourcing_invoke_mstest_clobbers_coverageoutput_param.md) · [TestCaseFilter OR](project_vstest_testcasefilter_or_operator_and_env_setup.md)
+- [File vs partial class](project_test_file_name_vs_partial_class_name.md) · [HintPath skew](project_analyzer_hintpath_skew_breaks_all_four_gates.md) · [Analyzer skew fresh](project_analyzer_version_skew_fresh_worktree.md) · [SecurityCodeScan](project_securitycodescan_roslyn56_incompat.md)
+- [VSTO runtime](project_missing_vsto_runtime_breaks_baseline_gates.md) · [MSB3277](project_new_sln_member_surfaces_msb3277_pin_divergence.md) · [No transitive refs](project_legacy_csproj_no_transitive_compile_refs.md) · [CRLF](project_sln_csproj_edit_crlf_preserve.md)
+- [Incremental vacuous](project_incremental_build_vacuous_baseline.md) · [Nullable /t:Build](project_nullable_build_gate_is_vacuous_incremental.md) · [Designer.cs skip](project_csharpier_skips_designer_cs_by_filename.md) · [*.log ignore](project_gitignore_star_log_blocks_committed_msbuild_log_evidence.md)
+- [pipe-files](project_csharpier_pipefiles_nonenforcing_gate.md) · [Count idioms](project_count_idiom_pitfalls_csharpier_and_measureobject.md) · [New .cs restart](project_new_cs_files_guarantee_a_format_loop_restart.md) · [PS BOM](powershell-bom-required.md)
+- [BOM grep ^](project_bom_grep_anchor_false_negative.md) · [StrictMode XML attr](project_pester_strictmode_xml_attribute_property_access.md) · [Pester helper BeforeAll](project_pester5_helper_function_must_live_in_beforeall.md)
+- [-NoExecute premise](project_noexecute_early_return_premise_hides_reachable_entry_point_tests.md) · [poshqc test no verdict](project_poshqc_pester_mcp_exit_minus1.md) · [analyze exit 1](project_poshqc_analyze_exit1_on_warning.md)
+- [Pester 5 result shape](project_pester5_result_shape_container_tests_and_ci_codecoverage.md) · [Heredoc \\](project_bash_heredoc_collapses_doubled_backslashes.md) · [Unquoted backslash](project_unquoted_backslash_in_bash_arg_silently_redirects_output.md)
+- [Doubled backslash](project_doubled_backslash_dedoubles_bash_to_native_exe.md) · [Recursive delete](project_recursive_delete_idioms_blocked_use_dotnet_api.md) · [pwsh -Command quoting](project_pwsh_command_quoting_from_bash.md)
+- [pwsh -File list](project_pwsh_file_array_param_from_bash.md) · [Compile-red refs](project_compile_red_needs_body_level_references.md) · [Splat gates](project_cross_task_shell_variable_splat_gate.md)
+- [<TS> collision](project_evidence_timestamp_collision_clobbers_artifacts.md) · [Floating <ts>](project_shared_evidence_artifact_floating_ts.md)
+
+## Test execution & isolation
+- [Detached long runs](project_long_runs_need_detached_process.md) · [Mock GUI](feedback_tests_must_mock_gui_no_visible_window.md) · [Suite hangs](project_full_suite_run_hangs_while_earlier_runs_idle.md)
+- [PumpHost flaky](project_winformspumphost_tests_load_flaky.md) · [/InIsolation](project_vstest_isolation_and_filepathhelper_serialization.md)
+- [Timed-out runner](project_timedout_mstest_leaves_detached_runner.md) · [Sibling tooling](project_sibling_worktree_shared_tooling_hazard.md) · [Concurrent executor](project_concurrent_executor_same_worktree.md)
+- [coverage deadlock](project_concurrent_dotnet_coverage_deadlock_and_doccomment_retention_gate.md) · [UtilitiesCS parallel](project_utilitiescs_test_parallelism_flakiness.md) · [DoNotParallelize](project_mstest_donotparallelize_overlaps_parallel_bucket.md)
+- [MemoryAppender per TYPE](project_log4net_memoryappender_shared_per_type_across_parallel_classes.md) · [Dispatcher swap race](project_uithread_dispatcher_static_swap_race.md) · [DataCollector default](project_runsettings_datacollector_default_enabled.md)
+- [Deedle/FSharp](project_dotnet_coverage_deedle_fsharp_instrumentation.md) · [DispatcherDelay hangs](project_dispatcherdelay_hangs_unit_tests.md) · [ConfigController STA](project_configcontroller_sta_pump_deadlock.md)
+
+## Coverage measurement
+- C# coverage mechanics (Cobertura, Koverage, denominators): see the sub-index at the top
+- [Package-rate not-lower gate vs variance](project_package_rate_not_lower_gate_trips_on_unrelated_file_variance.md) — unrelated-file variance fails package/repo not-lower gates on small-delta items
+- [Cobertura hits are binary](project_dotnet_coverage_cobertura_hits_are_binary.md) — dotnet-coverage hits are 0/1; "guard hits > record hits" can never hold; use the guard line's condition-coverage
+
+## Nullable / C# language
+- [Pragma gate](project_nullable_pragma_gate_mechanics.md) · [net481 pragma](project_nullable_pragma_gate_net481_mechanics.md) · [Epic pragma](project_nullable_epic_pragma_gate_and_analyzer_restore.md)
+- [CLAUDE.md != CI](project_507_nullconditional_return_triggers_cs8603_under_genuine_nullable_check.md) · [Annotations](project_nullable_remediation_annotation_patterns.md) · [CS8632](project_nullable_annotation_cs8632_scoping.md) · [CS8714](project_nullable_cs8714_not_on_net481.md)
+- [CS0518](project_record_struct_isexternalinit_netfx.md) · Closed issues and component gotchas: see the sub-index at the top
+
+## Artifact hygiene & misc mechanics
+- [No host paths](../_shared_no_absolute_host_paths.md) · [Never predict](feedback_never_predict_an_observation_into_an_artifact.md) · [<TS> drift](project_evidence_timestamp_labels_drift_ahead_of_write_time.md) · [Probe literal](project_selftest_probe_literal_trips_the_next_sweep_pass.md)
+- [TRX case](project_trx_sanitisation_must_be_case_insensitive.md) · [TRX/msbuild sanitise](project_vstest_trx_evidence_needs_sanitisation_task.md) · [msbuild 2 roots](project_msbuild_log_has_two_absolute_path_leak_classes.md) · [Deploy_ leaks](project_mstest_deploy_dir_leaks_tokens_on_failing_runs.md)
+- [Two .coverage](project_vstest_emits_two_coverage_files_per_run.md) · [No Failed line](project_vstest_success_run_prints_no_failed_or_skipped_line.md) · [Scratch .ps1](project_powershell_scratch_script_budget_hook_blocks_helpers.md) · [Mandated .ps1](project_plan_mandated_ps1_helpers_collide_with_budget_cap_and_frozen_porcelain_gate.md)
+- [2nd pass fields](project_appending_a_second_pass_must_not_qualify_schema_fields.md) · [env -C](project_bash_cwd_resets_use_env_dash_c.md) · [global.json cwd](project_dotnet_global_json_cwd_search_vs_bash_discipline.md) · [pwsh -File root](project_pwsh_file_starts_in_session_root_needs_workingdirectory.md)
+- [pwsh stdin REPL](project_pwsh_stdin_repl_mode_and_nonascii_mangling.md) · [Isolation guard](project_worktree_isolation_guard_refuses_pwsh_from_bash.md) · [Branch gate fix](project_changed_line_coverage_branch_gate_invalidated_by_the_fix.md)
+- [ExpectedExitCode](project_expectedexitcode_declared_from_baseline_not_observed_run.md) · [Blank before comment](project_csharpier_requires_blank_line_before_comment_breaking_numstat_bounds.md) · [this-lambdas](project_excludefromcodecoverage_misses_this_capturing_lambdas.md)
+- [Koverage separators](project_koverage_reporoot_needs_native_separators.md) · [FakeTimeProvider zero](project_faketimeprovider_zero_duetime_fires_at_creation.md) · [Reflective read](project_reflective_property_read_escapes_member_expression_grep.md)
+- [Preparation mode](project_preparation_mode_flips_anchored_diff_gate_membership.md) · [git grep -c oracle](project_git_grep_c_empty_is_the_allowlisted_line_count_oracle.md) · [Fallback orphans](project_contingency_fallback_orphans_downstream_hardcoded_paths.md)
+- [Per-comment literal](project_stale_citation_gate_literal_must_match_the_comments_legitimate_citations.md) · [TimeoutAfter race](project_timeoutafter_iscompleted_shortcircuit_loses_to_taskrun_race.md) · [Cobertura class nodes](project_cobertura_filename_maps_to_several_class_nodes.md)
+- [Logger double-counts](project_msbuild_filelogger_double_counts_each_warning.md) · [Reconciliation merge](project_orchestrator_reconciliation_merge_tracks_feature_docs.md) · [Seam sentences](project_preflight_seam_sentences_outlive_a_removed_member.md)
+- [Compile items](project_explicit_compile_items_decide_membership_not_file_presence.md) · [git add -N](project_intent_to_add_span_defeats_do_not_stage_invariant.md) · [Hunk header](project_git_hunk_header_literal_slides_past_blank_line.md)
+- [Budget hook out-of-root](project_batch_budget_hook_discards_out_of_root_powershell_writes.md) · [BOM .cs numstat](project_bom_bearing_cs_files_and_prerestore_numstat_head_gates.md) · [CLAUDE.md per worktree](project_claude_md_differs_between_worktrees_read_execution_copy.md)
+- [Token kill own shells](project_commandline_match_on_results_dir_token_kills_own_tool_shells.md) · [No .vsto](project_commandline_rebuild_omits_vsto_manifests_addin_cannot_load.md) · [git show ibm437](project_conservation_gate_git_show_decodes_ibm437_and_keeps_bom.md)
+- [$LASTEXITCODE StrictMode](project_coverage_helpers_dotsource_strictmode_lastexitcode_throws.md) · [Exactly-once literal](project_exactly_once_literal_clause_conflicts_with_pattern_containment_clause.md) · [Sibling test file](project_fixed_run_path_coverage_gate_blind_to_sibling_test_file.md)
+- [Promotion rename](project_footprint_inventory_clause_omits_inherited_promotion_rename.md) · [AC count claim](project_handoff_stated_ac_count_contradicts_the_ac_source_file.md) · [Kill by PID](project_killing_a_build_lock_waiter_by_script_name_hits_every_sibling.md)
+- [Malformed payload](project_malformed_pwsh_payload_surfaces_as_unrelated_hook_block.md) · [Blank line binding](project_mandatory_string_array_param_rejects_blank_line_turning_red_into_binding_error.md) · [Whole-file hunk](project_mergebase_diff_over_branch_created_file_is_whole_file_hunk.md)
+- [Mid-plan commit spans](project_midplan_commit_breaks_deletion_staging_and_porcelain_spans.md) · [Minute timestamps](project_minute_resolution_timestamp_cannot_be_strictly_increasing.md) · [/m N> prefix](project_msbuild_parallel_log_node_prefix_defeats_anchored_target_counts.md)
+- [Import-Module -Force](project_nested_import_module_force_unloads_session_wide.md) · [Hold-commits](project_parent_orchestrator_hold_commits_your_branch_midrun.md) · [Pester NotRun](project_pester_filtered_total_counts_notrun.md)
+- [Auto-property guard](project_plan_mandated_autoproperty_with_setter_guard_is_not_expressible.md) · [PoshQC format rules](project_poshqc_format_rewrites_differ_from_invoke_formatter_defaults.md) · [PoshQC BOM/CRLF](project_poshqc_format_strips_bom_and_crlf_only_when_it_rewrites.md)
+- [PS double-quote \\](project_powershell_double_quoted_backslash_defeats_msbuild_nonvacuity_grep.md) · [PSSA traps](project_psscriptanalyzer_traps_in_new_powershell_modules.md) · [$args param](project_pwsh_function_param_named_args_makes_msbuild_gate_vacuous.md)
+- [Nested quotes $( )](project_pwsh_nested_quotes_in_subexpression_fail_to_parse.md) · [$Log/$log](project_pwsh_param_name_case_collision_flattens_log_array.md) · [Reference rewrite](project_reference_version_rewrite_when_assemblyversion_omitted.md)
+- [Numstat elides](project_replacement_span_numstat_elides_identical_boundary_lines.md) · [Finding description](project_review_finding_line_number_right_description_wrong.md) · [Splatting lines](project_splatting_is_the_line_budget_lever_for_ceiling_bound_test_files.md)
+- [-WhatIf module scope](project_whatif_does_not_reach_module_session_state.md) · [Removal hook: git + "remove"](project_worktree_removal_hooks_match_git_plus_remove_substring.md)
+- [FluentAssertions truncates string diffs](project_fluentassertions_truncates_string_diff_breaks_message_substring_gates.md) — "…59Sandbox\origin": full-path MESSAGE substring gates cannot match
+- [Cited-tree gate vs main; span enumeration](project_preflight_cited_tree_gate_and_span_enumeration.md) — intersect cited paths with the files main changed; every stop string needs a task that detects it
+- [Field gate `Contains("EXIT_CODE:")` matches FORMAT_EXIT_CODE:](project_schema_field_contains_check_matches_prefixed_labels.md) — anchor the field match to the line start
+- [Worktree-gate hook: git + "remove" in any identifier](project_worktree_removal_hook_matches_git_plus_remove_in_variable_names.md) — read-only payloads with `$removed` halt the run; flag at preflight
+## Component-specific gotchas
+- [WebView2 EndInit creates child handles](project_webview2_endinit_creates_handles.md) · [#349 breadcrumb WebView2](project_349_breadcrumb_webview2_gotchas.md)
+- QFC #227: [cycle-4 ToggleFocus](project_qfc227_cycle4_toggle_focus_genuine_test_gotchas.md) · [cycle-3 seam](project_theme_folderpredictor_seam_retrofit_gotchas.md)
+- [ObjectListView headless selection](project_objectlistview_treelistview_headless_selection.md) · [BackgroundWorker async-void race](project_qfc_backgroundworker_async_void_race.md)
+- [QfcItemController needs SaveParameters](project_qfcitemcontroller_pump_harness_needs_saveparameters.md) · [TaskController (#297)](project_taskvisualization_taskcontroller_test_gotchas.md)
+- [ProjectEntry setter raw MessageBox](project_projectentry_setter_raw_messagebox.md) · [IApplicationGlobals member forces implementers](project_iapplicationglobals_member_forces_implementers.md)
+- [TimeProvider seam gotchas](project_timeprovider_seam_gotchas.md) · [GetOrLoad discards setter injection](project_initializer_getorload_discards_injection_when_dependency_null.md)
+- [ScoDictionaryNew needs TryAdd](project_scodictionarynew_tryadd_not_add.md) · [Equal(params) has no because](project_fluentassertions_equal_params_no_because.md) · [BeEmpty names only the first item](project_fluentassertions_beempty_names_only_first_item.md)
+## Artifact hygiene
+- [Never embed absolute host paths](../_shared_no_absolute_host_paths.md) · [Never predict an observation](feedback_never_predict_an_observation_into_an_artifact.md)
+- [<TS> drifts ahead of write time](project_evidence_timestamp_labels_drift_ahead_of_write_time.md) · [Probe literal trips the NEXT sweep](project_selftest_probe_literal_trips_the_next_sweep_pass.md)
+- [TRX sanitisation is case-insensitive](project_trx_sanitisation_must_be_case_insensitive.md) · [TRX/msbuild need a sanitisation micro-action](project_vstest_trx_evidence_needs_sanitisation_task.md)
+- [MSBuild logs leak TWO roots](project_msbuild_log_has_two_absolute_path_leak_classes.md) · [Deploy_ leaks tokens on FAILING runs](project_mstest_deploy_dir_leaks_tokens_on_failing_runs.md)
+- [vstest leaves TWO .coverage files](project_vstest_emits_two_coverage_files_per_run.md) · [Green run prints no Failed/Skipped line](project_vstest_success_run_prints_no_failed_or_skipped_line.md)
+- [PS budget hook blocks scratch .ps1](project_powershell_scratch_script_budget_hook_blocks_helpers.md) · [Plan-mandated .ps1 + frozen porcelain gate](project_plan_mandated_ps1_helpers_collide_with_budget_cap_and_frozen_porcelain_gate.md)
+- [2nd pass must not qualify schema fields](project_appending_a_second_pass_must_not_qualify_schema_fields.md) · [Bash resets cwd; use `env -C`](project_bash_cwd_resets_use_env_dash_c.md)
+- [global.json cwd-search vs no-cd discipline](project_dotnet_global_json_cwd_search_vs_bash_discipline.md) · [pwsh -File starts in the SESSION root](project_pwsh_file_starts_in_session_root_needs_workingdirectory.md)
+- [pwsh stdin is a REPL](project_pwsh_stdin_repl_mode_and_nonascii_mangling.md) · [Isolation guard refuses pwsh from Bash](project_worktree_isolation_guard_refuses_pwsh_from_bash.md)
+- [ExpectedExitCode keyed off the baseline](project_expectedexitcode_declared_from_baseline_not_observed_run.md) · [Koverage -RepoRoot needs native separators](project_koverage_reporoot_needs_native_separators.md)
+- [CSharpier forces a blank line before a comment](project_csharpier_requires_blank_line_before_comment_breaking_numstat_bounds.md) · [ExcludeFromCodeCoverage misses `this`-capturing lambdas](project_excludefromcodecoverage_misses_this_capturing_lambdas.md)
+- [Koverage -RepoRoot needs native separators](project_koverage_reporoot_needs_native_separators.md) · [FakeTimeProvider zero due time fires at creation](project_faketimeprovider_zero_duetime_fires_at_creation.md)
+- [Reflective property read escapes a member grep](project_reflective_property_read_escapes_member_expression_grep.md) · [Preparation mode flips anchored-diff membership](project_preparation_mode_flips_anchored_diff_gate_membership.md)
+- [git grep -c with an empty pattern is the line-count oracle](project_git_grep_c_empty_is_the_allowlisted_line_count_oracle.md) - Read renders a phantom trailing line
+- [Contingency fallback orphans downstream paths](project_contingency_fallback_orphans_downstream_hardcoded_paths.md) · [Stale-citation gate literal is per-comment](project_stale_citation_gate_literal_must_match_the_comments_legitimate_citations.md)
+- [TimeoutAfter IsCompleted loses to the Task.Run race](project_timeoutafter_iscompleted_shortcircuit_loses_to_taskrun_race.md) · [One Cobertura filename, several class nodes](project_cobertura_filename_maps_to_several_class_nodes.md)
+- [msbuild file logger double-counts warnings](project_msbuild_filelogger_double_counts_each_warning.md) · [Reconciliation merge already tracks the feature docs](project_orchestrator_reconciliation_merge_tracks_feature_docs.md)
+- [Seam sentences outlive a removed member](project_preflight_seam_sentences_outlive_a_removed_member.md) — after a decision removes an interface member, grep the spec for "Moq double of the .* interface"/"injectable"; keyword sweeps miss them
+- [Explicit Compile items decide membership, not file presence](project_explicit_compile_items_decide_membership_not_file_presence.md) — a grep hit can be uncompiled
+- [`git add -N -- .` defeats a "do not stage X" invariant](project_intent_to_add_span_defeats_do_not_stage_invariant.md) — it reads as diff plumbing, so a staging audit skips it
+- [Hunk-header literal slides past a blank line](project_git_hunk_header_literal_slides_past_blank_line.md) — measured; assert numstat deleted=0, never `@@ -N,0 +M,`
+- [Batch-budget hook discards out-of-root .ps1 writes](project_batch_budget_hook_discards_out_of_root_powershell_writes.md) — hook roots at session worktree; plan gates reading its state become unsatisfiable
+- [BOM-bearing .cs files + pre-restore numstat gates](project_bom_bearing_cs_files_and_prerestore_numstat_head_gates.md)
+- [CLAUDE.md differs per worktree; read the execution copy](project_claude_md_differs_between_worktrees_read_execution_copy.md)
+- [CommandLine token kill hits own bash/pwsh shells](project_commandline_match_on_results_dir_token_kills_own_tool_shells.md)
+- [CLI Rebuild omits .vsto/.manifest](project_commandline_rebuild_omits_vsto_manifests_addin_cannot_load.md)
+- [git show in pwsh decodes ibm437 + keeps BOM](project_conservation_gate_git_show_decodes_ibm437_and_keeps_bom.md)
+- [Dot-sourced coverage helpers: StrictMode $LASTEXITCODE throws](project_coverage_helpers_dotsource_strictmode_lastexitcode_throws.md)
+- [Exactly-once literal vs pattern-containment clause](project_exactly_once_literal_clause_conflicts_with_pattern_containment_clause.md)
+- [Fixed run-path coverage gate blind to sibling test file](project_fixed_run_path_coverage_gate_blind_to_sibling_test_file.md)
+- [Inventory clause omits inherited promotion rename](project_footprint_inventory_clause_omits_inherited_promotion_rename.md)
+- [Handoff AC count is a claim; measure the AC file](project_handoff_stated_ac_count_contradicts_the_ac_source_file.md)
+- [Kill build-lock waiter by PID, not script name](project_killing_a_build_lock_waiter_by_script_name_hits_every_sibling.md)
+- [Malformed pwsh payload surfaces as unrelated hook block](project_malformed_pwsh_payload_surfaces_as_unrelated_hook_block.md)
+- [Mandatory [string[]] rejects a blank line](project_mandatory_string_array_param_rejects_blank_line_turning_red_into_binding_error.md)
+- [Merge-base diff over branch-created file = one whole-file hunk](project_mergebase_diff_over_branch_created_file_is_whole_file_hunk.md)
+- [Mid-plan commit breaks deletion staging/porcelain spans](project_midplan_commit_breaks_deletion_staging_and_porcelain_spans.md)
+- [Minute-resolution timestamps can't be strictly increasing](project_minute_resolution_timestamp_cannot_be_strictly_increasing.md)
+- [/m "N>" prefix zeroes anchored target counts](project_msbuild_parallel_log_node_prefix_defeats_anchored_target_counts.md)
+- [Nested Import-Module -Force unloads session-wide](project_nested_import_module_force_unloads_session_wide.md)
+- [Parent orchestrator hold-commits your branch mid-run](project_parent_orchestrator_hold_commits_your_branch_midrun.md)
+- [Pester TotalCount includes filtered NotRun](project_pester_filtered_total_counts_notrun.md)
+- [Auto-property with setter guard is not expressible](project_plan_mandated_autoproperty_with_setter_guard_is_not_expressible.md)
+- [PoshQC format != Invoke-Formatter defaults](project_poshqc_format_rewrites_differ_from_invoke_formatter_defaults.md)
+- [PoshQC strips BOM/CRLF only on rewrite](project_poshqc_format_strips_bom_and_crlf_only_when_it_rewrites.md)
+- [PS double quotes keep both backslashes](project_powershell_double_quoted_backslash_defeats_msbuild_nonvacuity_grep.md)
+- [4 PSScriptAnalyzer traps in new modules](project_psscriptanalyzer_traps_in_new_powershell_modules.md)
+- [Param named $args makes msbuild gate vacuous](project_pwsh_function_param_named_args_makes_msbuild_gate_vacuous.md)
+- [Nested quotes in "$( )" fail to parse](project_pwsh_nested_quotes_in_subexpression_fail_to_parse.md)
+- [$Log/$log case collision flattens array](project_pwsh_param_name_case_collision_flattens_log_array.md)
+- [pwsh @(a + x, b + y) is ONE string](project_pwsh_array_literal_comma_binds_before_plus.md)
+- [Pre-impl gate reads the SESSION-root checkpoint](project_preimplementation_gate_reads_session_root_checkpoint_not_item_worktree.md)
+- [Invoke-VersionReconciliation rewrites Reference version](project_reference_version_rewrite_when_assemblyversion_omitted.md)
+- [Replaced-span numstat elides identical boundary lines](project_replacement_span_numstat_elides_identical_boundary_lines.md)
+- [Finding's line right, description wrong](project_review_finding_line_number_right_description_wrong.md)
+- [Splatting frees lines in ceiling-bound test files](project_splatting_is_the_line_budget_lever_for_ceiling_bound_test_files.md)
+- [-WhatIf does not reach module ShouldProcess](project_whatif_does_not_reach_module_session_state.md)
+- [WinForms control field installs SyncContext, deadlocks await](project_winforms_control_field_installs_synccontext_and_deadlocks_await.md)
+- [Backtick-span Grep returns gaps](project_backtick_span_grep_gap_matches.md) — manual blast-radius token re-check
+## Artifact hygiene, shell/pwsh pitfalls, misc (sub-index)
+- [Sub-index: 58 entries](index_artifact_hygiene_and_misc.md) — evidence sanitisation, TRX/msbuild path leaks, pwsh quoting, csharpier/numstat, git spans, Pester, hooks
+- [Caller fact list can be abbreviated](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md) — a correct citation can read as contradicting a "do not re-verify" fact
+- [git grep -I skips UTF-16 evidence](project_git_grep_binary_flag_skips_utf16_evidence.md)
diff --git a/.claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md b/.claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md
new file mode 100644
index 000000000..effd9a07c
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md
@@ -0,0 +1,21 @@
+---
+name: mstest-runner-summary-absent-on-failure-voids-flaky-carveout
+description: Invoke-MSTestWithCoverageMain writes mstest-coverage-run.summary.txt only after a zero collector exit, so a flaky-test carve-out keyed on its "Failed tests:" line can never fire; key it on the raw trx instead
+metadata:
+  type: project
+---
+
+`scripts/vscode/Invoke-MSTestWithCoverage.ps1` throws `MSTest with coverage failed with exit code N`
+inside `Invoke-DotnetCoverageCollection` (line 262 as of 2026-10-09) before post-processing, the
+projection, and the summary file are produced. The `.summary.txt` holding
+`Failed tests: <names>` therefore exists only on a green run, and it always reads `Failed tests: none`.
+
+**Why:** plan #985 r0 C7 allowed one re-measurement when `RUNNER_RESULT=THREW` and the
+`TRX-SUMMARY: Failed tests:` line named only the known flaky test (#780). On a red run that line is
+never printed (the wrapper deletes the stale summary first), so the rule was unreachable and a
+single flaky failure would have become a hard STOP.
+
+**How to apply:** at preflight, a flaky carve-out over this runner must read failed names from
+the raw `coverage\test-results\mstest-coverage-run.trx` (still present after the throw), e.g.
+`//*[local-name()='UnitTestResult'][@outcome='Failed']` -> `testName`, printed as
+`TRX-FAILED-TEST:` lines (names only, no paths). Related: [[flaky-test-carveout-added-to-one-task-only]].
diff --git a/.claude/agent-memory/atomic-executor/project_poshqc_analyze_flags_new_verb_test_helpers_and_comma_return.md b/.claude/agent-memory/atomic-executor/project_poshqc_analyze_flags_new_verb_test_helpers_and_comma_return.md
new file mode 100644
index 000000000..f07555121
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_poshqc_analyze_flags_new_verb_test_helpers_and_comma_return.md
@@ -0,0 +1,15 @@
+---
+name: project-poshqc-analyze-flags-new-verb-test-helpers-and-comma-return
+description: PoshQC analyze fails on New-* helper functions inside Pester BeforeAll (ShouldProcess rule) and on unary-comma returns whose OutputType says string[]; MCP gives only an issue count
+metadata:
+  type: project
+---
+
+The bundled PoshQC analyzer (mcp__drm-copilot__run_poshqc_analyze) returned `ok: false` with only "PSScriptAnalyzer reported 7 issue(s)" on issue #985. A plain `Invoke-ScriptAnalyzer -Path <file>` (default rules) over the Write Set reproduced exactly the same 7 findings, so it is a usable diagnosis route when the MCP tool gives no detail.
+
+The two finding classes:
+- PSUseShouldProcessForStateChangingFunctions (Warning) on test-file helper functions named `New-*` defined inside a Pester `BeforeAll` (fixture builders such as New-AppConfigText). Fix: name fixture builders with the `Get-` verb.
+- PSUseOutputTypeCorrectly (Information, still counted) on a private helper that returns `, [string[]]$value` with `[OutputType([string[]])]`: the analyzer infers Object[]. Fix: emit values unwrapped with `[OutputType([string])]` and have callers collect with `@(...)`.
+
+**Why:** each costs a full PowerShell loop restart (format, analyze, test, coverage) under the plan's C7 rule.
+**How to apply:** when writing new Pester helpers or module helpers, use Get- verbs and avoid unary-comma returns from the start; when the MCP analyze reports only a count, run Invoke-ScriptAnalyzer per file to list them. See also [[project-rehearsal-merge-x-ours-drops-adjacent-manifest-edits]].
diff --git a/.claude/agent-memory/atomic-executor/project_rehearsal_merge_x_ours_drops_adjacent_manifest_edits.md b/.claude/agent-memory/atomic-executor/project_rehearsal_merge_x_ours_drops_adjacent_manifest_edits.md
new file mode 100644
index 000000000..3d91b8059
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_rehearsal_merge_x_ours_drops_adjacent_manifest_edits.md
@@ -0,0 +1,13 @@
+---
+name: project-rehearsal-merge-x-ours-drops-adjacent-manifest-edits
+description: In a Dependabot-branch rehearsal, git merge -X ours silently dropped fix insertions/deletions next to bumped manifest lines; nuget update CLI leaves test app.config redirects stale
+metadata:
+  type: project
+---
+
+Issue #985 rehearsal (2026-10-09): merging the fix branch into the PR #984 Dependabot branch with `git merge -X ours` exited 0 with an empty porcelain, yet dropped two of four packages.config insertions (those adjacent to `MSTest.TestFramework` lines Dependabot bumped) and the deletion of a duplicate csproj ItemGroup. Only a content check (Grep per declaration, blob equality per script) revealed it; the merge stat was the only visible hint (two manifests and the csproj missing from it).
+
+Also observed: `nuget update <packages.config> -Id X -Version Y` rewrites the manifest and the csproj HintPaths/References but does not touch the project's app.config binding redirect, and it writes the manifest in a non-canonical form that Invoke-ManifestNormalization then reflows.
+
+**Why:** a rehearsal that trusts the merge exit code would build a tree that is not the fix.
+**How to apply:** after any `-X ours`/`-X theirs` rehearsal merge, verify every fix element by content and re-apply drops; expect the repair run after a simulated nuget update to write app.config redirects (OwnReference) and the updated manifests (normalisation). Related: [[project-poshqc-analyze-flags-new-verb-test-helpers-and-comma-return]].
diff --git a/.claude/agent-memory/atomic-planner/MEMORY.md b/.claude/agent-memory/atomic-planner/MEMORY.md
index 2625834e8..33fae36b6 100644
--- a/.claude/agent-memory/atomic-planner/MEMORY.md
+++ b/.claude/agent-memory/atomic-planner/MEMORY.md
@@ -2,97 +2,13 @@
 
 ## Preflight revision seams (per issue; newest first)
 
-- [#973 R1](project_973_r1_last_task_artifact_only_commit_and_measured_line_length_seams.md) — last task commits its artifact alone (plan is clean until its flip); dossier cites no later result; flip then transcribe; measure line length with `^.{N,}` (CR +1); Glob zero-gate needs a positive-control Glob; loop-fix commit needs `<paths>`
-- [#973 cycle 1](project_973_cycle1_premise_correction_refscan_and_tautology_fold_seams.md) — false-premise AC fixed by a metadata refscan + positive control; a "tautology" may be an analyzer workaround (fold the read into the real assertion, amend the AC operand); hunk header omits `,1`; commit-per-task flip-then-commit
-- [#964 cycle 1](project_964_cycle1_test_only_coverage_gap_remediation_seams.md) — test-only coverage-gap plan: dossier not fail-before, data-row trx prefix match, commit-task check-off circularity, no-Bash gitdir reads
-
-- [#968 R5](project_968_r5_multi_pass_format_exemption_and_no_bash_cr_check_seams.md) — a format exemption keyed to "rewritten this pass" fails on any restart: add PRIOR-PASS-REWRITTEN + RESTART-CORRECTED (union of ALL corrections); no Bash means Grep `\r` for the CR check
-- [#968 R4](project_968_r4_restart_path_reanchor_and_recorded_not_gated_exemption_seams.md) — restart into a pre-commit census needs BASE ref + membership porcelain; exempt recorded-not-gated values (HUNK_COUNT, SPAN) from "as last recorded"; #region hits need a category
-- [#968 R3](project_968_r3_last_recorded_value_rule_and_merged_payload_hook_seams.md) — post-format census must say "as last recorded for its file"; classification stop-rules must cover method-group assignments; merged pwsh payloads trip the gh+issue+new hook; re-count spec facts after amendments
-- [#964 R4](project_964_r4_post_merge_footprint_reanchor_with_negative_controls.md) — mid-plan merge: move only the whole-tree footprint gate to MERGE-SHA, add two committed-range negative controls; no Bash means no hash-object
-- [#964 R3](project_964_r3_glob_backslash_and_hit_attribution_seams.md) — Glob paths are backslash (rev-parse HEAD: needs `/`); totals-only sweep can't decide per-file branch
-- [#964 R2](project_964_r2_preparation_record_closed_evidence_set.md) — preparation commits preflight-clearance.*.md before execution; closed evidence sets must admit + blob-pin it
-- [#964 R0-R1](project_964_partial_split_sink_guard_plan_seams.md) — Grep tokens are regex; ordinal multiset split census; pre-existing-failure rule compares trx FQNs; last-task hygiene sweep
-- [#950 R2](project_950_r2_self_matching_process_probe_and_bom_numstat_seams.md) — CommandLine process probe counts itself; BOM drop adds +1/-1 numstat; failed set hides aborted tests
-- [#950 R1](project_950_r1_inline_continuation_and_reindent_width_seams.md) — default TCS continues inline so Drain() is vacuous; using() re-indent breaks width
-- [#950 v1.0](project_950_hygiene_blocks_absolute_prefix_and_always_failing_probe_seams.md) — absolute prefix breaks hygiene rule B; always-failing probe; commit task's own artifact in porcelain
-- [#956 R1.2](project_956_r12_rethrow_brace_exemptions_and_indent_keyed_catch_rule.md) — lifting EFCC exposes braces after `throw;`; construct-identified exemptions; catch rule keyed to indent
-- [#956 R1](project_956_r1_spec_self_hit_and_raw_doc_name_seams.md) — spec-wording counts self-hit the AC line; anchor `cobertura[^/]*\.xml$`; amended AC needs a P0 literal check
-- [#953 R3](project_953_r3_grep_gitignore_directory_path_and_measured_line_lengths.md) — Grep honours .gitignore for a DIRECTORY path, Glob does not; measure line lengths with `^.{N,}`
-- [#953 R2](project_953_r2_grep_long_line_omission_and_cr_anchor_seams.md) — Grep omits lines over ~500 chars; `$` fails before CR (`\r?$`); expect-fail needs a wrong-reason branch
-- [#953 R1](project_953_r1_pwsh_refused_and_count_recheck_seams.md) — Bash guard refuses pwsh; re-count blocks per file; `-Force` count-0 self-hits
-- [#953 R0](project_953_fizzler_redirect_sweep_and_ratchet_plan_seams.md) — ripgrep strips the BOM; text=auto hides CRLF loss (gate `git ls-files --eol`)
-- [#952 R3](project_952_r3_shared_origin_main_ancestry_gate_seam.md) — origin/main is shared by all worktrees: a no-fetch plan still needs a P0 `merge-base == BASE-SHA` gate
-- [#952 R2](project_952_r2_label_counts_helper_enumeration_and_hex_backslash_seams.md) — recount `all N required` labels; directory-enumerating helper reads every file; backslash as `\x5C`
-- [#952 R1](project_952_r1_read_phantom_row_and_frozen_clause_a_seams.md) — Read trailing empty row is inconsistent (count with Grep `^`); freeze footprint Clause A from P0
-- [#952 R0](project_952_runbook_and_workflow_comment_plan_seams.md) — `.yml` edits are pre-impl-gated; CRLF adds 1 to line length; actionlint silent on success
-- [#948 v0.3](project_948_sibling_first_shape_reconciliation_seams.md) — sibling lands first: named shapes with content anchors, baseline-relative try/catch gate, re-budget 500-line ceiling
-- [#947 pass A](project_947_passA_second_call_site_consolidation_seams.md) — mid-plan second call site: nested catch end keyed to header indent; re-derive "N catch clauses"
-- [#945 R0](project_945_sortemail_trysave_directory_seam_plan_seams.md) — whitespace-stripped token census; compile-red fail-before; uncommitted-fix control via backup copy
-- [#940 R3](project_940_r3_per_file_coverage_rule_and_post_merge_reanchor_seams.md) — aggregate not-lower gates trip on variance; per-file lines+branches rule; ANCHOR-SHA-2 = `<merge>^2`
-- [#929 R5](project_929_r5_text_auto_terminator_only_formatter_rewrite_seam.md) — `* text=auto` makes a terminator-only rewrite uncommittable; key the commit on numstat non-empty
-- [#929 R4](project_929_r4_wrapper_led_hook_containment_and_actions_log_seams.md) — pr-author hook matches gh+pr+create substrings in any pwsh payload; strip SGR from Actions logs
-- [#929 R3](project_929_r3_post_merge_ci_sourced_gates_seams.md) — feature push starts NO ci.yml run; red-by-design needs ExpectedExitCode 1; no-shell git facts from .git/worktrees
-- [#927 v1.15](project_927_r12_three_dot_anchor_and_control_ref_ancestry_seams.md) — after a mid-plan merge use `origin/main...HEAD`; read the reflog before adopting a control ref
-- [#927 v1.14](project_927_r11_ci_sourced_coverage_and_multiset_fidelity_seams.md) — PoshQC returns only an ok flag: counts from JUnit, coverage from CI; blob-level multiset
-- [#927 v1.13](project_927_v113_checkoff_must_read_the_pre_record_seams.md) — after a gate becomes pre/post, sweep consumers; Tee-Object -Append is a write
-- [#927 v1.12](project_927_v112_two_point_census_and_ac_amendment_seams.md) — post-cleanup zero needs a pre-cleanup 1; ripgrep transcodes UTF-16; AC-amendment placement
-- [#927 R10](project_927_r10_ci_session_state_and_folder_level_mcp_seams.md) — payload mirroring CI needs StrictMode + Stop; QA-loop commits break "every commit at a boundary"
-- [#927 R9](project_927_r9_pwsh_process_directory_and_backslash_collapse_seams.md) — Set-Location does not move the .NET process dir; Git Bash collapses `\\`
-- [#927 R8](project_927_r8_powershell_batch_phases_and_post_merge_reanchor_seams.md) — PS batch-budget hook is per session; a mid-run main merge voids BASE-SHA diffs
-- [#928 R1-R2](project_928_r1_part_file_credit_diagnostic_seams.md) — a "part file 5/5" diagnostic cannot fail; Pester mocks beat re-dot-source
-- [Legacy seams #136–#900](index_legacy_preflight_seams_pre_900.md) — sub-index of every per-issue seam note for #839 and earlier (#900, #895, #873, #871, #839 … #136)
-- [#882 R0](project_882_transactiongate_bounded_acquisition_plan_seams.md) — spec's own token pre-falsifies repo-wide absence; analyzer skew back (3.0.235/4.4.0 vs 3.0.290/4.4.1), copy from primary checkout; runner emits projections only after its asserts, compose them in a helper; `[char]96` fences
-- [#927 R16](project_927_r16_ledger_phrase_census_and_transcription_attribution_seams.md) — a ledger phrase census must include the summary UNMET parenthetical (three lines, not two); a figure an acceptance requires in an artifact needs a reading step or a "transcribed, read by preflight round N" label; a count-only file reference ("two part files") is a placeholder preflight fills with names; a deferred check-off task's own acceptance must carry the guard reading its host task states
-- [#927 R15](project_927_r15_pull_request_merge_ref_and_ledger_recount_seams.md) — a pull_request CI run checks out the PR head merged with main's TIP, so a merge-base CI baseline needs a MAIN-TIP-NOW/MAIN-MOVED guard read after a fetch (NOT MET with BASELINE-SCOPE, not a stop); a ledger phrase matches two lines (Items-remaining + per-criterion): say which is removed/replaced and recount every derived count; appended post-commit tasks need their own confirming guard run; attribute main's movement CI-to-CI in plain prose
-- [#927 R14](project_927_r14_premerge_local_baseline_reanchored_to_merge_base_ci_seams.md) — a pre-merge local coverage baseline is voided by the mid-plan merge (main moved 0.01 itself): re-anchor to main's CI run at the merge base, compare CI vs CI, control = local vs stale local through the same parser; vstest green run prints Total tests/Passed only (case-sensitive filters, artifacts carry BASELINE-PASSED:); a pwsh function that prints then returns leaks the prints into the return; coordinator "and pushes" / "don't add to C12" clauses conflicted with C9 and "no other task stops"
-- [#927 R13](project_927_r13_delta_text_violates_own_check_and_quoted_phrase_residue.md) — run a returned delta's own check over the delta text before pasting (D1 spelled the contiguous segment it forbade); never quote a replaced phrase in the plan's record (absence search finds it); Edit preserves CRLF on multi-line inserts; Bash may be fully disabled, read reflogs with Read
-- [#927 R6-R7](project_927_evidence_hygiene_sweep_plan_seams.md) — blast-radius extractor harvests multi-word INLINE spans; fence non-written payloads; colon-bang exclusions and directory tokens never harvested; R7: a final gate compared against a baseline figure the baseline task never recorded (log overwritten by the QA run) — record a labelled row and name it; "as P0-Tn" inheritance must be re-derived aloud
-- [#928 R5](project_928_backtick_descoping_blast_radius_seams.md) — every inline span is a WRITE claim to the parallel scheduler; a "Glob pattern **/*.xml" span serializes the item; accepted vs dropped token shapes; fenced blocks unharvested; context paths in plain prose only
-- [#929 R0-R2](project_929_manifest_residuals_plan_seams.md) — PS comma binds tighter than + (parenthesise pattern elements, gate PATTERNS=N); bare `[A-Za-z]:\\` matches `client-id:\s` (guard + SELFTEST_NEG); relative hit paths; restart on Write Set rewrite only; csharpier check can't rewrite; analyzer tuples drop line numbers for edited files; repair script verifies repaired text (DISAGREE may be 0); list-sdks prints [path]; no preflight signal strings in plan body; Import rule already exists; Meziantou 3.0.235 vs 3.0.290 CS0006; promotion commit breaks BASE-SHA footprint; `\\` de-doubled Bash->pwsh
-- [#930 R0-R4](project_930_uithread_ilglobals_comments_plan_seams.md) — enumerate gated names in check-off citations, never count them; runner writes `<stem>.cobertura.jacoco.xml` + trx summary; dot-source + redefine Get-DotnetCoverageArgumentList; Bash collapses `''`, misbinds `""` inside `$( )`, halves `\\` (use [char]39/34/92); processed Cobertura filenames are backslash-separated; Grep-tool literals need regex escaping note; config/blast-radius.json `"modules"` key in source scope; no /t:Build for intermediate compiles
-- [#931 R0-R4](project_931_uncontrolled_environment_tests_plan_seams.md) — R4: loop re-runs need per-iteration `ITERATION:` artifacts + highest-value selection; gate on "every iteration recorded REWRITTEN: 0", never "task X recorded"; core.autocrlf IS readable from a worktree (system config) — the R3 claim was wrong; re-grep occurrence claims after writing the round record. R3: autocrlf=true breaks revert SHA anchors (checkout writes CRLF, Write tool writes LF, diff --exit-code still 0): delete-then-checkout EOL restore in the fix-commit task, anchors AFTER it; .editorconfig [*.{cs,vb}] end_of_line=crlf; stale-output removal must include the runner's summary.txt; never backtick w/crlf-style tokens. R2: POST prints floor lines every run (route-independent gates); clear runner fixed-name outputs + stage copies before each run; (d0)/(d) aborted-run branches decided before POST; per-test admissibility; CMD-ADDED-LINES payload with positive control. R0-R1: runner asserts floors FIRST and throws raw on a failed test; comment literals inflate the census; alignment-dependent added-line counts; moved remarks carry `Workers=0`; Tee-Object no parent dir; MSBUILDDISABLENODEREUSE for child scripts; AC16 "zero failed" bars the #780 flake post-fix; post-control Write Set edits are a stop; backslash out-of-Write-Set pathspecs
-- [#942 R0-R2](project_942_prime_fault_report_then_clear_plan_seams.md) — runner DELETES raw Cobertura outside coverage\ (transcribe .jacoco.xml/.summary.txt, never copy); [DataTestMethod] lacks [TestMethod]; R1: format BEFORE the code commit then P3 format must rewrite 0; two-window hunk rule on single-occurrence anchors; reflog at .git/worktrees/<id>/logs/HEAD readable without Bash; amend AC13 to name the inherited promotion record; R2: count columns of every gated single-line token (a 101-col BeEmpty call breaks into a chain and counts 0), gate reason strings by same-line FIRST-LINE equality, name the numstat command, cite POST-FORMAT sections, never pin a commit count
-- [#944 R0-R2](project_944_prime_marker_registration_plan_seams.md) — UTF-8 git show decoding; re-derive "partition" line by line; STAGED-NEW; -C operand never double-quoted backslash; pass-2 rewrites first EXIT_CODE
-- [#927](project_927_evidence_identity_hygiene_sweep_plan_seams.md) — AC per-file arithmetic fixes the guard's counting unit; git-grep-I-equivalent binary skip; pure Assert-GitExitCode seam (never invoke git); removal list from the guard's own lines; cobertura ignore pattern hits the runner's projection name; CITATION paths need a slash; backticked non-path slash tokens are harvested
-- [#928](project_928_scoped_threshold_mcp_only_plan_seams.md) — MCP-only executor cannot measure scripts/vscode coverage (three-route task + work order); PoshQC format rewrote 0 of 46 so the issue's drift claim was Invoke-Formatter-default; verbose-mode regexes and multi-word spans keep slash tokens out of the harvest; RED for the right reason
-- [#839](project_839_createcancellationtoken_init_plan_seams.md) — lone dead-comment deletion not CSharpier-stable; post-commit porcelain must admit the plan's own check-off; never record a porcelain COUNT; Phase 0 diff sentences prospective; exempt commit form `-m ... -- path`
-- [#838 R1–R2](project_838_gettableinviewasync_null_contract_plan_seams.md) — timed CTS ctors DO exist (13 lines); porcelain gates assert SCOPE only; folder-wide commit task names NO artifact; repeatable literals at-least-one; ExpectedExitCode = observed value
-- [#871](project_871_qfcqueue_enqueue_seams_plan_seams.md) — relocated-vs-new must be diff-derived (whitespace-stripped +/- match); a PS try/catch can't catch an external process (use 2>&1 + $LASTEXITCODE); a projected repo-wide rate over 65k lines can't fail (gate the delta); scope-lock needs an anchor carve-out
-- [#602 R1-R3](project_602_host_identifier_sweep_plan_seams.md) — literal-free counts = ONE pwsh segment; never `git add -A`; backticked prose glob = harvested path; exit-1 baselines need ExpectedExitCode (every Pester baseline too); SELF-REVIEW anchors on task IDs never plan line numbers
-- [#873 R2](project_873_evidence_projection_plan_seams.md) — It-level mock overrides beyond the BeforeEach; [int]GetAttribute('hits') throws when the attribute is absent
-- [#792 R2](project_792_breadcrumb_webview2_init_plan_seams.md) - a bare token gate is pre-falsified by a sibling member name; no-arg CoreWebView2EnvironmentOptions leaves AdditionalBrowserArguments null; the -o backtick scan spans between tokens; moving a Write Set path leaves prose residuals in sibling sentences
-- [#900 R2](project_900_r2_channel_gate_and_hash_placement_seams.md) — isolation refuses pwsh -Command and -File alike; #539 exemption models only -m (never -F) and exempt trees; probe channel + read checkpoint in Phase 0 with stop branches; hash spans after the probe; relative ASSEMBLY line can't carry the worktree segment; copy XML to artifacts/ only after the last clean format
-- [#900 R1](project_900_dedicated_thread_mutation_placement_seams.md) — mutation placed before the precondition tests the wrong assertion; injected-ops overload throws at `:80` not `:364`; potential entries are MCP-only (executor hands off); `\"` corrupts `-Command` payloads; wrapped spec markers break count gates
-- [#895 R0](project_895_fsharp_core_hintpath_plan_seams.md) — spec's "no 879 folder" false; AC5 token occurs twice; DataRow DisplayName bracket token; Rebuild keeps copied-ref timestamps; Meziantou 3.0.203 nuget bootstrap; runner state from console literals; hook path check hit 8/48 first lines
-- [#816 R1-R3](project_816_iscompleted_branch2_ac5_plan_seams.md) — re-derive recovered figures; `coverage/.gitkeep` tracked; porcelain vacuous (hash instead); HangDumpType=None; green vstest prints no Failed:/Skipped: line; brace has no Cobertura line element; every delta clause needs a baseline count
-- [#826 factory](project_826_factory_outside_try_reachability_seams.md) · [#826 R2-R5](project_826_console_out_banned_symbol_plan_seams.md) — seam outside `try`; `0 Error(s)` substring of `10 Error(s)`; uncompiled control emits nothing
-- [#825 R1-R6](project_825_etl_deadline_mechanics_plan_seams.md) — latch encodes fixed timer order; Csc line names no project; runner excludes test dll; a comment above a cited range shifts it
-- [#824 R1-R5](project_824_ilglobals_static_publication_plan_seams.md) — gate the installer's FS marker; "move" must state deletion; `--amend` hits the preceding task's commit; sort TRX by LastWriteTime
-- [#823](project_823_self_anchor_diff_base_seams.md) — self-anchor at P0; check-off can complete with AC unmet; never key ExpectedExitCode to a baseline count
-- [#821 R1](project_821_parentcleanup_double_release_plan_seams.md) — Read over-counts one line; Select-String is case-insensitive; untested pre-existing catch voids member gate
-- [#815](project_815_coverage_aggregation_exposure_plan_seams.md) — zero baseline needs a positive control; pinned allowlist zeroes the helper; 500 legal, 501 not
-- [#810 R1-R2](project_810_teardown_dropdown_residuals_plan_seams.md) — inherited paths as a RULE; never upper-bound a csharpier delta; TokenSource null before Cleanup
-- [#798 R1](project_798_qfc_column_timeout_plan_seams.md) — frozen write set vs 882-line member; unwired seam observes 0; paren anchor misses generics
-- [#797](project_797_folder_settings_persistence_plan_seams.md) — runner TestCaseFilter hard-coded; generic logger has no attach point; admitted red baseline voids exit-0 demands
-- [#791](project_791_hc_deadline_cancel_teardown_plan_seams.md) · [#781](project_781_excludefromcodecoverage_guard_plan_seams.md) — QfcDatamodel excluded; no shell var survives; ExcludeFromCodeCoverage unmeasurable
-- [#752](project_752_relative_path_anchor_plan_seams.md) · [#751 R3](project_751_r3_detached_launch_seams.md) · [#751 R2](project_751_sync_barrier_revision_seams.md) — `(^|\\)` anchor; detached launch sentinels; `nuget restore`
-- [#736 R1-R5](project_736_efc_archiveroot_boundary_sink_plan_seams.md) · [#735 R1](project_735_evidence_content_sanitization_seams.md) — 485-line test file voids Write Set; name-only sanitization can't fail
-- [#731 R1-R5](project_731_lifecycle_disposal_plan_seams.md) · [#731 R6-R12](project_731_r6_coverage_runner_bypass_seams.md) — near-limit forces partial; runner self-blocks in agent worktree
-- [#680](project_680_menu_mode_plan_seams.md) · [#678](project_678_carry_folder_predictor_plan_seams.md) · [#677 R1-R8](project_677_keyboard_focus_leak_plan_seams.md) — HostTests 499; runner throws twice; ctor param REJECTED
-- [#670 fault](project_670_webview_fault_boundary_plan_seams.md) · [#670 sanitisation](project_670_capture_time_sanitisation_seams.md) · [#663](project_663_qfc_alt_chord_plan_seams.md) — awaiter breaks "no pump"; indirect vswhere leak; compile-red to runtime red
-- [#662](project_662_banner_prefix_arity_plan_seams.md) · [R2](project_662_banner_prefix_revision_round_seams.md) · [R3](project_662_round3_trx_hygiene_and_verbatim_seams.md) — `AC5` prefixes `AC5b`; `*.trx` NOT gitignored
-- [#656](project_656_closecompleted_guard_plan_seams.md) · [#648](project_648_ungated_static_swap_plan_seams.md) · [#647 R1-R2](project_647_fileio2_retry_plan_seams.md) — no TestCaseFilter override; 5% tolerance; explicit `/Settings:`
-- [#644](project_644_ac16_referral_revision_seams.md) · [c2](project_644_cycle2_sweep_gate_evasion_seams.md) · [PA-7](project_644_pa7_redaction_plan_seams.md) — named instrument prints no figure; rewording is evasion
-- [#637 R6](project_637_r6_superseded_spec_claim_seams.md) · [R2-R5](project_637_selectrow_rooted_path_plan_seams.md) · [#635](project_635_reflective_caller_audit_plan_seams.md) · [#633](project_633_undo_handoff_plan_seams.md)
-- [#614](project_614_store_root_leak_plan_seams.md) · [#553](project_553_ci_parallel_split_plan_seams.md) · [#512](project_512_toolchain_gate_fidelity_plan_seams.md) · [#511 R1](project_511_r1_preflight_delta_seams.md)
-- [#505](project_505_toggle_state_guards_plan_seams.md) · [#503](project_503_ribbon_readiness_plan_seams.md) · [#501 R1](untracked-file-and-linecount-gate-seams.md) · [#501 R3](project_501_r3_preflight_seams.md)
-- [#498](conditional-ladder-and-unowned-class-gates.md) · [#497 F16](project_497_f16_capstone_plan_seams.md) · [#494](project_494_threshold_reconciliation_plan_seams.md) · [#493](project_493_uithread_dispatcher_plan_seams.md)
-- [#489](project_489_partn_reroute_amendment_seams.md) · [#484](project_484_qfc_revision_seams.md) · [capacity squeeze](project_qfcitemcontroller_test_capacity_squeeze.md) · [#469](project_469_comment_accuracy_plan_seams.md)
-- [#468 preflight](project_468_preflight_revision_seams.md) · [#468 QFC](project_468_qfc_collection_controller_plan_seams.md) · [#464](project_464_efc_controller_plan_seams.md) · [#457](project_457_closure_filter_plan_seams.md)
-- [#456 F14](project_456_f14_itemviewer_plan_seams.md) · [#455 F13](project_455_f13_breadcrumb_webview_plan_seams.md) · [#453](project_453_qfcitemcontroller_plan_seams.md) · [#452 F9](project_452_efc_form_item_viewer_plan_seams.md)
-- [#442](project_442_quickfiler_metrics_plan_seams.md) · [#441](project_441_cobertura_arithmetic_plan_seams.md) · [#440](project_440_breadcrumb_left_arrow_plan_seams.md) · [#437](project_437_efc_home_controller_plan_seams.md)
-- [#433 F7](project_433_f7_qfchomecontroller_plan_seams.md) · [#432](project_432_coverage_ledger_plan_seams.md) · [#430](project_430_quickfiler_keyboard_plan_seams.md) · [#400](project_400_partial_class_headroom_placement.md) · [#136](project_136_wave1_nonhalting_f1_dependency.md)
+- [#985 R1](project_985_r1_scratchpad_identity_and_double_write_seams.md) — never spell the scratchpad (encoded name holds the account); sweep diff + untracked; reflowed tag forces a double write
+- [#985 R0](project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md) — merge-into-Dependabot rehearsal needs a simulated nuget update; hygiene guard flags Users paths in tracked plans; Invoke-VSBuild rewrites csproj
+- [#973 R1](project_973_r1_last_task_artifact_only_commit_and_measured_line_length_seams.md) — last task commits its artifact alone; dossier cites no later result; measure line length with `^.{N,}`; Glob zero-gate needs a positive control
+- [#973 cycle 1](project_973_cycle1_premise_correction_refscan_and_tautology_fold_seams.md) — false-premise AC fixed by a refscan + positive control; a "tautology" may be an analyzer workaround; commit-per-task flip-then-commit
+- [#964 cycle 1](project_964_cycle1_test_only_coverage_gap_remediation_seams.md) — test-only coverage-gap plan: dossier not fail-before, data-row trx prefix match, commit-task check-off circularity
+- [Seams #882–#973](index_preflight_seams_900_to_973.md) — sub-index: #968, #964 R0-R4, #959, #956, #953, #952, #950, #948, #947, #945, #940, #931, #930, #929, #928, #927, #944, #942, #882, #973 R0-R6
+- [Legacy seams #136–#900](index_legacy_preflight_seams_pre_900.md) — sub-index of every per-issue seam note for #900 and earlier (#900, #895, #873, #871, #839 … #136)
 
 ## Plan structure and revision mechanics
 
@@ -153,23 +69,4 @@
 
 ## Artifact hygiene
 
-- [No absolute host paths](../_shared_no_absolute_host_paths.md) — use `<repo-root>` / `<user>` / `<host>`
-- [#973 R6](project_973_r6_fold_governing_clarification_into_dictated_sentence_seam.md) — an accepted planner clarification replaces the dictated sentence as ONE rule (delete the superseded wording and the "planner clarification, revision N" label; sweep both to 0); quote and re-verify the following-line literal (count 1) in the same pass; re-stamp the drifted "Revision N applied" note under the bounded record
-- [#973 R5](project_973_r5_positional_restore_rule_and_enumeration_self_hit_recurrence_seams.md) — a dictated restore rule phrased by line POSITION picks the wrong line after the deletion shifted lines and is silent on an adjacent pair's order (clarify by text identity, flag the addition); enumeration self-hit recurred (re-run the superseded-literal and digit Greps after writing section 14); re-measure dictated figures with the delta's own pattern
-- [#973 R4](project_973_r4_member_multiset_formatter_blank_lines_and_optional_trailer_seams.md) — a declaration census is a MULTISET (two identical overload lines, 195/224); formatter-forced blank lines beside a moved block need a spec amendment backed by multiline-Grep zeros; attribution may omit Claude-Session (`TRAILER-2: none`); `\bCS(...)\b` on every code pattern; `hash-object --no-filters` under text=auto; a restore branch cascades into numstat/name-list expectations; Bash can be disabled outright
-- [#973 R3](project_973_r3_scope_fold_scripted_region_move_and_renumbered_tail_seams.md) — move a region by marker-anchored pwsh copy (not transcription) and cut the blank lines above the `#region`; a fallback `git checkout <sha> -- csproj` discards later Compile Includes; insert check-offs before the status/commit tail; format-sensitive Write Set files need a loop-fix commit; `\x60` = backtick in Grep; .NET file APIs ignore Set-Location
-- [#973 R2](project_973_r2_log_entry_self_hit_pester_unroll_and_figure_carrying_artifact_seams.md) — a revision-log entry quoting the OLD self-matching literal re-creates the self-hit (describe it in prose; re-measure the folder count after every log edit); Pester 5 unrolls a one-element expected array (`Expected 'x', because ..., but got @('x', 'y')`); a check-off must cite the artifact that RECORDS the figure (P3-T13 SLAE line), not an earlier task
-- [#973 R1](project_973_r1_current_census_union_string_should_message_and_self_hit_pattern_seams.md) — post-sweep file list = stale UNION already-corrected (measure the corrected-version census in P0); `-BeExactly` on strings prints `but they were different`, not `, but got`; `/c/Users/` quoted in a host-path gate self-hits the plan (write `/c/Users[\\/]`); commit trailers are session facts (placeholders + hook char rule); no absolute WORKTREE line even as a placeholder definition; _pester.yml floors a 3-folder union; TRX summary line 2 ends `, failed N.`
-- [#973 R0](project_973_r0_range_guard_vacuous_before_and_coverage_tolerance_seams.md) — a range-only redirect guard is never red before a sweep (stale entries read `0.0.0.0-X`/`X`; pin via the csproj Reference map); strict first-party coverage `>=` baseline fails on identical-tree noise (0.10 pp tolerance when denominators equal); no Bash: read `.git/worktrees/<id>/HEAD` + refs; `\r$` vs `^` counts show csproj/packages.config lack a trailing newline
-- [#959 R13](project_959_r13_two_sided_path_census_and_recorded_not_gated_rate_comparison_seams.md) — fan-in additions-only gate must compute the two-sided path set mechanically (SHARED-WITH-LOSS + a `0 1` control), not name "the one overlap"; same-tree two-decimal rate comparison is recorded not gated, family rows are the gate; FILES floors must equal their breakdown sums
-- [#959 R10](project_959_r10_append_phases_review_residuals_and_pr_time_merge_seams.md) — append phases to an executed plan: Cobertura condition-coverage as the discriminator for a coverage-only test; pwsh payload hook rule (git + worktree path + remove); post-merge fan-in anchored at the fetched origin/main SHA with committed-range controls; fixed-name artifacts rewritten with ITERATION/SUPERSEDES; main-side csproj hunk read from a sibling worktree
-- [#959 R9](project_959_r9_mid_phase_insertion_renumber_and_iteration2_rerun_seams.md) — insert tasks into an executed final phase: two-step `P6-Tx` renumbering, orphan stop record under the old number, ITERATION-2 re-run keeps the earlier artifact name, doc-comment widening gated by diff-identity labels not a test
-- [#959 R8](project_959_r8_fluentassertions_string_diff_truncation_message_gate_seam.md) — FluentAssertions string Be() prints only a window after an ellipsis around the first differing index: gate the assertion-subject text + string tails (`GetDirectoryName(helper.FilePathSaveAlt)`, `origin"`), never a path literal; count/integer messages are not truncated; a fixed-name stop record is rewritten in full by the re-run
-- [#959 R7](project_959_r7_ac_by_reference_spec_correction_and_delta_backtick_seams.md) — an AC that says "exact types in Technical specifications" incorporates them: a seam-type change must correct those spec lines in place and gate them in the check-off task; reviewer deltas use double backticks as delimiters; "0 lines" self-review claims self-hit
-- [#959 R6](project_959_r6_cs1769_embedded_interop_generic_seam_and_per_task_commit_gates.md) — CS1769: `Func<Attachment,...>` cannot cross UtilitiesCS (EmbedInteropTypes True) to its test project; use a nested non-generic delegate, add a census state column instead of editing executed columns; per-task commits: own-edit gates keep the working-tree `MERGE-BASE` form, earlier-task gates use `MERGE-BASE HEAD`, porcelain is pre-commit only
-- [#959 R5](project_959_r5_bash_dedoubles_backslashes_in_pwsh_command_payloads.md) — Bash de-doubles `\\` in a pwsh -Command payload (`[\\/]` becomes `[\/]`, zero-count gate over backslash paths unsatisfiable); normalize with `[char]92` + forward-slash pattern, add True/False controls, whole-plan `\\` sweep classifying payload vs Listing vs prose
-- [#959 R4](project_959_r4_shared_anchor_controls_native_exit_labels_and_schema_rows_first_seams.md) — a control must share the predicate's `$anchor` variable and have a positive twin; every native call needs its own `$LASTEXITCODE` label (not-found leaves 0); schema rows first (first occurrence wins); loop-rule "edit only spec.md" must name the repair branch
-- [#959 R3](project_959_r3_checkoff_evidence_precedes_edit_and_line_anchored_field_check_seams.md) — a check-off must run its gate before the Edit and forward-record it; `Contains("EXIT_CODE:")` matches `FORMAT_EXIT_CODE:` (anchor `(?m)^[^\w\r\n]*` + printed False control); task row enumerations drop the plain `EXIT_CODE:` row
-- [#959 R2](project_959_r2_pre_existing_evidence_ordering_and_no_git_channel_seams.md) — "unless PRE-EXISTING-EVIDENCE names it" is always true for an earlier task's artifact; evidence-field INHERITED = Clause A minus own P0 artifacts, run twice; no Bash: record caller git claims as statements, cite .gitignore by content
-- [#959 R1](project_959_r1_census_initializer_displayname_and_worktree_claude_filter_seams.md) — census tokens match field initializers; DisplayName rows inflate method-name counts; `*\.claude\*` absolute filter excludes an item worktree entirely; AC26 allows only three evidence subfolders; flaky-branch ACs need conditional check-off; declare compile-red spans
-- [#959 R0](project_959_r0_resume_append_point_and_nonexempt_hash_seams.md) — resume banner repeats the APPEND-POINT marker; AC lines are `- [ ] ACn (`; post-format Edits "indentation as found"; AC25 gate = hash of `<file>::<text>` non-exempt uncovered set; rule (3) needs both shapes once the outer catch goes
+- [No absolute host paths](../_shared_no_absolute_host_paths.md) — use `<repo-root>` / `<user>` / `<host>`; the CI hygiene guard flags drive-rooted Users paths in any tracked file (see #985 R0)
diff --git a/.claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md b/.claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md
new file mode 100644
index 000000000..c34786d3a
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md
@@ -0,0 +1,82 @@
+---
+name: index-preflight-seams-900-to-973
+description: Sub-index of per-issue preflight revision seam notes for issues #882 through #973 (moved out of MEMORY.md on 2026-10-09 to keep the main index under its size limit); open this when a plan touches one of those issues' files or components, or before planning PowerShell/C# QA gates, coverage runners, hygiene sweeps or commit-per-task mechanics
+metadata:
+  type: reference
+---
+
+Per-issue preflight seam notes for #882 to #973, newest first within each group. Each link is a sibling file in this directory. Older notes: [[index-legacy-preflight-seams-pre-900]].
+
+## #968 to #882
+
+- [#968 R5](project_968_r5_multi_pass_format_exemption_and_no_bash_cr_check_seams.md) — a format exemption keyed to "rewritten this pass" fails on any restart: add PRIOR-PASS-REWRITTEN + RESTART-CORRECTED (union of ALL corrections); no Bash means Grep `\r` for the CR check
+- [#968 R4](project_968_r4_restart_path_reanchor_and_recorded_not_gated_exemption_seams.md) — restart into a pre-commit census needs BASE ref + membership porcelain; exempt recorded-not-gated values (HUNK_COUNT, SPAN) from "as last recorded"; #region hits need a category
+- [#968 R3](project_968_r3_last_recorded_value_rule_and_merged_payload_hook_seams.md) — post-format census must say "as last recorded for its file"; classification stop-rules must cover method-group assignments; merged pwsh payloads trip the gh+issue+new hook; re-count spec facts after amendments
+- [#964 R4](project_964_r4_post_merge_footprint_reanchor_with_negative_controls.md) — mid-plan merge: move only the whole-tree footprint gate to MERGE-SHA, add two committed-range negative controls; no Bash means no hash-object
+- [#964 R3](project_964_r3_glob_backslash_and_hit_attribution_seams.md) — Glob paths are backslash (rev-parse HEAD: needs `/`); totals-only sweep can't decide per-file branch
+- [#964 R2](project_964_r2_preparation_record_closed_evidence_set.md) — preparation commits preflight-clearance.*.md before execution; closed evidence sets must admit + blob-pin it
+- [#964 R0-R1](project_964_partial_split_sink_guard_plan_seams.md) — Grep tokens are regex; ordinal multiset split census; pre-existing-failure rule compares trx FQNs; last-task hygiene sweep
+- [#950 R2](project_950_r2_self_matching_process_probe_and_bom_numstat_seams.md) — CommandLine process probe counts itself; BOM drop adds +1/-1 numstat; failed set hides aborted tests
+- [#950 R1](project_950_r1_inline_continuation_and_reindent_width_seams.md) — default TCS continues inline so Drain() is vacuous; using() re-indent breaks width
+- [#950 v1.0](project_950_hygiene_blocks_absolute_prefix_and_always_failing_probe_seams.md) — absolute prefix breaks hygiene rule B; always-failing probe; commit task's own artifact in porcelain
+- [#956 R1.2](project_956_r12_rethrow_brace_exemptions_and_indent_keyed_catch_rule.md) — lifting EFCC exposes braces after `throw;`; construct-identified exemptions; catch rule keyed to indent
+- [#956 R1](project_956_r1_spec_self_hit_and_raw_doc_name_seams.md) — spec-wording counts self-hit the AC line; anchor `cobertura[^/]*\.xml$`; amended AC needs a P0 literal check
+- [#953 R3](project_953_r3_grep_gitignore_directory_path_and_measured_line_lengths.md) — Grep honours .gitignore for a DIRECTORY path, Glob does not; measure line lengths with `^.{N,}`
+- [#953 R2](project_953_r2_grep_long_line_omission_and_cr_anchor_seams.md) — Grep omits lines over ~500 chars; `$` fails before CR (`\r?$`); expect-fail needs a wrong-reason branch
+- [#953 R1](project_953_r1_pwsh_refused_and_count_recheck_seams.md) — Bash guard refuses pwsh; re-count blocks per file; `-Force` count-0 self-hits
+- [#953 R0](project_953_fizzler_redirect_sweep_and_ratchet_plan_seams.md) — ripgrep strips the BOM; text=auto hides CRLF loss (gate `git ls-files --eol`)
+- [#952 R3](project_952_r3_shared_origin_main_ancestry_gate_seam.md) — origin/main is shared by all worktrees: a no-fetch plan still needs a P0 `merge-base == BASE-SHA` gate
+- [#952 R2](project_952_r2_label_counts_helper_enumeration_and_hex_backslash_seams.md) — recount `all N required` labels; directory-enumerating helper reads every file; backslash as `\x5C`
+- [#952 R1](project_952_r1_read_phantom_row_and_frozen_clause_a_seams.md) — Read trailing empty row is inconsistent (count with Grep `^`); freeze footprint Clause A from P0
+- [#952 R0](project_952_runbook_and_workflow_comment_plan_seams.md) — `.yml` edits are pre-impl-gated; CRLF adds 1 to line length; actionlint silent on success
+- [#948 v0.3](project_948_sibling_first_shape_reconciliation_seams.md) — sibling lands first: named shapes with content anchors, baseline-relative try/catch gate, re-budget 500-line ceiling
+- [#947 pass A](project_947_passA_second_call_site_consolidation_seams.md) — mid-plan second call site: nested catch end keyed to header indent; re-derive "N catch clauses"
+- [#945 R0](project_945_sortemail_trysave_directory_seam_plan_seams.md) — whitespace-stripped token census; compile-red fail-before; uncommitted-fix control via backup copy
+- [#940 R3](project_940_r3_per_file_coverage_rule_and_post_merge_reanchor_seams.md) — aggregate not-lower gates trip on variance; per-file lines+branches rule; ANCHOR-SHA-2 = `<merge>^2`
+- [#929 R5](project_929_r5_text_auto_terminator_only_formatter_rewrite_seam.md) — `* text=auto` makes a terminator-only rewrite uncommittable; key the commit on numstat non-empty
+- [#929 R4](project_929_r4_wrapper_led_hook_containment_and_actions_log_seams.md) — pr-author hook matches gh+pr+create substrings in any pwsh payload; strip SGR from Actions logs
+- [#929 R3](project_929_r3_post_merge_ci_sourced_gates_seams.md) — feature push starts NO ci.yml run; red-by-design needs ExpectedExitCode 1; no-shell git facts from .git/worktrees
+- [#927 v1.15](project_927_r12_three_dot_anchor_and_control_ref_ancestry_seams.md) — after a mid-plan merge use `origin/main...HEAD`; read the reflog before adopting a control ref
+- [#927 v1.14](project_927_r11_ci_sourced_coverage_and_multiset_fidelity_seams.md) — PoshQC returns only an ok flag: counts from JUnit, coverage from CI; blob-level multiset
+- [#927 v1.13](project_927_v113_checkoff_must_read_the_pre_record_seams.md) — after a gate becomes pre/post, sweep consumers; Tee-Object -Append is a write
+- [#927 v1.12](project_927_v112_two_point_census_and_ac_amendment_seams.md) — post-cleanup zero needs a pre-cleanup 1; ripgrep transcodes UTF-16; AC-amendment placement
+- [#927 R10](project_927_r10_ci_session_state_and_folder_level_mcp_seams.md) — payload mirroring CI needs StrictMode + Stop; QA-loop commits break "every commit at a boundary"
+- [#927 R9](project_927_r9_pwsh_process_directory_and_backslash_collapse_seams.md) — Set-Location does not move the .NET process dir; Git Bash collapses `\\`
+- [#927 R8](project_927_r8_powershell_batch_phases_and_post_merge_reanchor_seams.md) — PS batch-budget hook is per session; a mid-run main merge voids BASE-SHA diffs
+- [#928 R1-R2](project_928_r1_part_file_credit_diagnostic_seams.md) — a "part file 5/5" diagnostic cannot fail; Pester mocks beat re-dot-source
+- [#882 R0](project_882_transactiongate_bounded_acquisition_plan_seams.md) — spec's own token pre-falsifies repo-wide absence; analyzer skew back (3.0.235/4.4.0 vs 3.0.290/4.4.1), copy from primary checkout; runner emits projections only after its asserts, compose them in a helper; `[char]96` fences
+- [#927 R16](project_927_r16_ledger_phrase_census_and_transcription_attribution_seams.md) — a ledger phrase census must include the summary UNMET parenthetical (three lines, not two); a figure an acceptance requires in an artifact needs a reading step or a "transcribed, read by preflight round N" label; a count-only file reference ("two part files") is a placeholder preflight fills with names; a deferred check-off task's own acceptance must carry the guard reading its host task states
+- [#927 R15](project_927_r15_pull_request_merge_ref_and_ledger_recount_seams.md) — a pull_request CI run checks out the PR head merged with main's TIP, so a merge-base CI baseline needs a MAIN-TIP-NOW/MAIN-MOVED guard read after a fetch (NOT MET with BASELINE-SCOPE, not a stop); a ledger phrase matches two lines (Items-remaining + per-criterion): say which is removed/replaced and recount every derived count; appended post-commit tasks need their own confirming guard run; attribute main's movement CI-to-CI in plain prose
+- [#927 R14](project_927_r14_premerge_local_baseline_reanchored_to_merge_base_ci_seams.md) — a pre-merge local coverage baseline is voided by the mid-plan merge (main moved 0.01 itself): re-anchor to main's CI run at the merge base, compare CI vs CI, control = local vs stale local through the same parser; vstest green run prints Total tests/Passed only (case-sensitive filters, artifacts carry BASELINE-PASSED:); a pwsh function that prints then returns leaks the prints into the return; coordinator "and pushes" / "don't add to C12" clauses conflicted with C9 and "no other task stops"
+- [#927 R13](project_927_r13_delta_text_violates_own_check_and_quoted_phrase_residue.md) — run a returned delta's own check over the delta text before pasting (D1 spelled the contiguous segment it forbade); never quote a replaced phrase in the plan's record (absence search finds it); Edit preserves CRLF on multi-line inserts; Bash may be fully disabled, read reflogs with Read
+- [#927 R6-R7](project_927_evidence_hygiene_sweep_plan_seams.md) — blast-radius extractor harvests multi-word INLINE spans; fence non-written payloads; colon-bang exclusions and directory tokens never harvested; R7: a final gate compared against a baseline figure the baseline task never recorded (log overwritten by the QA run) — record a labelled row and name it; "as P0-Tn" inheritance must be re-derived aloud
+- [#928 R5](project_928_backtick_descoping_blast_radius_seams.md) — every inline span is a WRITE claim to the parallel scheduler; a "Glob pattern **/*.xml" span serializes the item; accepted vs dropped token shapes; fenced blocks unharvested; context paths in plain prose only
+- [#929 R0-R2](project_929_manifest_residuals_plan_seams.md) — PS comma binds tighter than + (parenthesise pattern elements, gate PATTERNS=N); bare `[A-Za-z]:\\` matches `client-id:\s` (guard + SELFTEST_NEG); relative hit paths; restart on Write Set rewrite only; csharpier check can't rewrite; analyzer tuples drop line numbers for edited files; repair script verifies repaired text (DISAGREE may be 0); list-sdks prints [path]; no preflight signal strings in plan body; Import rule already exists; Meziantou 3.0.235 vs 3.0.290 CS0006; promotion commit breaks BASE-SHA footprint; `\\` de-doubled Bash->pwsh
+- [#930 R0-R4](project_930_uithread_ilglobals_comments_plan_seams.md) — enumerate gated names in check-off citations, never count them; runner writes `<stem>.cobertura.jacoco.xml` + trx summary; dot-source + redefine Get-DotnetCoverageArgumentList; Bash collapses `''`, misbinds `""` inside `$( )`, halves `\\` (use [char]39/34/92); processed Cobertura filenames are backslash-separated; Grep-tool literals need regex escaping note; config/blast-radius.json `"modules"` key in source scope; no /t:Build for intermediate compiles
+- [#931 R0-R4](project_931_uncontrolled_environment_tests_plan_seams.md) — per-iteration `ITERATION:` artifacts; core.autocrlf readable from a worktree; autocrlf=true breaks revert SHA anchors (delete-then-checkout EOL restore); stale-output removal includes the runner's summary.txt; runner asserts floors FIRST and throws raw on a failed test; MSBUILDDISABLENODEREUSE for child scripts; AC16 "zero failed" bars the #780 flake post-fix
+- [#942 R0-R2](project_942_prime_fault_report_then_clear_plan_seams.md) — runner DELETES raw Cobertura outside coverage\ (transcribe .jacoco.xml/.summary.txt); [DataTestMethod] lacks [TestMethod]; format BEFORE the code commit; two-window hunk rule; reflog readable without Bash; count columns of gated single-line tokens; gate reason strings by FIRST-LINE equality; never pin a commit count
+- [#944 R0-R2](project_944_prime_marker_registration_plan_seams.md) — UTF-8 git show decoding; re-derive "partition" line by line; STAGED-NEW; -C operand never double-quoted backslash; pass-2 rewrites first EXIT_CODE
+- [#927](project_927_evidence_identity_hygiene_sweep_plan_seams.md) — AC per-file arithmetic fixes the guard's counting unit; git-grep-I-equivalent binary skip; pure Assert-GitExitCode seam; removal list from the guard's own lines; cobertura ignore pattern hits the runner's projection name; CITATION paths need a slash
+- [#928](project_928_scoped_threshold_mcp_only_plan_seams.md) — MCP-only executor cannot measure scripts/vscode coverage (three-route task + work order); PoshQC format rewrote 0 of 46; verbose-mode regexes keep slash tokens out of the harvest; RED for the right reason
+
+## #973 R0-R6 and #959 R0-R13
+
+- [#973 R6](project_973_r6_fold_governing_clarification_into_dictated_sentence_seam.md) — an accepted planner clarification replaces the dictated sentence as ONE rule; quote and re-verify the following-line literal; re-stamp the drifted "Revision N applied" note
+- [#973 R5](project_973_r5_positional_restore_rule_and_enumeration_self_hit_recurrence_seams.md) — a restore rule phrased by line POSITION picks the wrong line after a deletion; enumeration self-hit recurred; re-measure dictated figures with the delta's own pattern
+- [#973 R4](project_973_r4_member_multiset_formatter_blank_lines_and_optional_trailer_seams.md) — a declaration census is a MULTISET; formatter-forced blank lines need a spec amendment; attribution may omit Claude-Session; `hash-object --no-filters` under text=auto; Bash can be disabled outright
+- [#973 R3](project_973_r3_scope_fold_scripted_region_move_and_renumbered_tail_seams.md) — move a region by marker-anchored pwsh copy; a fallback `git checkout <sha> -- csproj` discards later Compile Includes; format-sensitive Write Set files need a loop-fix commit; .NET file APIs ignore Set-Location
+- [#973 R2](project_973_r2_log_entry_self_hit_pester_unroll_and_figure_carrying_artifact_seams.md) — a revision-log entry quoting the OLD literal re-creates the self-hit; Pester 5 unrolls a one-element expected array; a check-off must cite the artifact that RECORDS the figure
+- [#973 R1](project_973_r1_current_census_union_string_should_message_and_self_hit_pattern_seams.md) — post-sweep file list = stale UNION already-corrected; `-BeExactly` prints `but they were different`; host-path gate literal self-hits the plan; _pester.yml floors a 3-folder union; TRX summary line 2 ends `, failed N.`
+- [#973 R0](project_973_r0_range_guard_vacuous_before_and_coverage_tolerance_seams.md) — a range-only redirect guard is never red before a sweep (pin via the csproj Reference map); strict first-party coverage `>=` baseline fails on noise (0.10 pp tolerance); csproj/packages.config lack a trailing newline
+- [#959 R13](project_959_r13_two_sided_path_census_and_recorded_not_gated_rate_comparison_seams.md) — fan-in additions-only gate needs a mechanical two-sided path set; same-tree two-decimal rate comparison is recorded not gated
+- [#959 R10](project_959_r10_append_phases_review_residuals_and_pr_time_merge_seams.md) — append phases to an executed plan; Cobertura condition-coverage discriminator; post-merge fan-in anchored at the fetched origin/main SHA
+- [#959 R9](project_959_r9_mid_phase_insertion_renumber_and_iteration2_rerun_seams.md) — two-step task renumbering, orphan stop record, ITERATION-2 re-run keeps the earlier artifact name
+- [#959 R8](project_959_r8_fluentassertions_string_diff_truncation_message_gate_seam.md) — FluentAssertions string Be() prints only a window around the first difference; gate subject text + tails, never a path literal
+- [#959 R7](project_959_r7_ac_by_reference_spec_correction_and_delta_backtick_seams.md) — an AC that incorporates spec sections by reference needs those spec lines corrected and gated
+- [#959 R6](project_959_r6_cs1769_embedded_interop_generic_seam_and_per_task_commit_gates.md) — CS1769 across EmbedInteropTypes; per-task commit gate forms
+- [#959 R5](project_959_r5_bash_dedoubles_backslashes_in_pwsh_command_payloads.md) — Bash de-doubles `\\` in pwsh -Command payloads; normalize with `[char]92`
+- [#959 R4](project_959_r4_shared_anchor_controls_native_exit_labels_and_schema_rows_first_seams.md) — controls share the predicate's anchor; every native call needs its own `$LASTEXITCODE` label; schema rows first
+- [#959 R3](project_959_r3_checkoff_evidence_precedes_edit_and_line_anchored_field_check_seams.md) — a check-off runs its gate before the Edit; `Contains("EXIT_CODE:")` matches `FORMAT_EXIT_CODE:`
+- [#959 R2](project_959_r2_pre_existing_evidence_ordering_and_no_git_channel_seams.md) — "unless PRE-EXISTING-EVIDENCE names it" is always true for an earlier artifact; no Bash: record caller git claims as statements
+- [#959 R1](project_959_r1_census_initializer_displayname_and_worktree_claude_filter_seams.md) — census tokens match field initializers; DisplayName rows inflate counts; `*\.claude\*` filter excludes an item worktree
+- [#959 R0](project_959_r0_resume_append_point_and_nonexempt_hash_seams.md) — resume banner repeats the APPEND-POINT marker; AC lines are `- [ ] ACn (`; non-exempt uncovered-set hash gate
diff --git a/.claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md b/.claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md
new file mode 100644
index 000000000..84e35693f
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md
@@ -0,0 +1,17 @@
+---
+name: project-985-r0-rehearsal-fidelity-and-hygiene-path-seams
+description: "#985 round 0 plan seams - a merge-the-fix-into-the-Dependabot-branch rehearsal is unfaithful when the fix adds package declarations (the test projects stay pinned to the old version; simulate Dependabot's bump with nuget update per new pair); the hygiene guard fails CI on any drive-rooted Users path in a tracked file, including the plan itself and caller-supplied scratchpad paths; Invoke-VSBuild runs Sync-PackageReferences which rewrites csproj HintPaths; rehearsal merges need -X ours plus content re-apply"
+metadata:
+  type: project
+---
+
+Planning #985 (2026-10-09; Dependabot repair: borrowed test packages + transitive binding redirects) surfaced four seams.
+
+**Why:** each would have produced a false rehearsal failure or a red hygiene CI job unrelated to the fix.
+
+**How to apply:**
+- A rehearsal that merges a fix adding `packages.config` declarations into an existing Dependabot branch leaves the newly declaring projects at the pre-bump version while their production references are bumped; the post-merge `@dependabot recreate` would bump them too. Insert a simulated Dependabot step (`nuget update <proj>\packages.config -Id -Version -RepositoryPath`) for each new pair whose production sibling differs, leave redirects to the repair script, and flag the decision to the caller (the AC text did not mention it).
+- `scripts/hygiene/Test-RepositoryHygiene.Rules.ps1` line 21 flags `[a-z]:[\\/]+users[\\/]+...` in every tracked file. A caller-supplied scratchpad path (C-drive Users temp dir) must be written as `$env:LOCALAPPDATA\Temp\...` in the plan, and every helper script must replace roots and profile paths before printing. Positive control for a zero-count scan: the linked worktree's `.git` pointer file matches once.
+- `scripts/vscode/Invoke-VSBuild.ps1` lines 247-253 run `Sync-PackageReferences.ps1` before building, which can rewrite csproj HintPaths; for manifest-defect work resolve MSBuild via vswhere and run the CLAUDE.md arguments directly.
+- Long helper payloads go into scratch `.ps1` files outside the repo (the PS batch-budget hook ignores paths outside the root, line 288), which also removes Bash-to-pwsh quoting hazards.
+- Related: [[project-930-uithread-ilglobals-comments-plan-seams]] (runner dot-source + redefine for the shell-icon filter), [[poshqc-mcp-and-msbuild-invocation-facts]].
diff --git a/.claude/agent-memory/atomic-planner/project_985_r1_scratchpad_identity_and_double_write_seams.md b/.claude/agent-memory/atomic-planner/project_985_r1_scratchpad_identity_and_double_write_seams.md
new file mode 100644
index 000000000..9b5e0a468
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/project_985_r1_scratchpad_identity_and_double_write_seams.md
@@ -0,0 +1,17 @@
+---
+name: project-985-r1-scratchpad-identity-and-double-write-seams
+description: "#985 R1 remediation seams - the session scratchpad's encoded directory name carries the account name, so a plan must never spell it (define SCRATCH as 'the scratchpad named in the executor's environment'); a pre-commit identity sweep must read diff-added lines AND untracked files with run-time-derived tokens plus synthetic and .git-pointer controls; a reflowed assemblyBinding start tag makes the sync and normalisation passes write one app.config twice"
+metadata:
+  type: project
+---
+
+Remediation cycle 1 of #985 (2026-10-09) was driven by review B-1: the round-0 plan wrote the encoded session-scratchpad folder through `$env:LOCALAPPDATA`, which removed the drive-rooted path but kept the account name inside the encoded segment (`C--Users-<user>-...`).
+
+**Why:** the caller-supplied scratchpad path always embeds the account name in its encoded worktree segment, so any plan that copies it leaks the identifier even when it avoids a drive-rooted path; the CI hygiene pattern does not catch it (no colon).
+
+**How to apply:**
+- Define `SCRATCH` as "the session scratchpad named in the executing agent's own environment block"; never spell it, not even via an environment variable. Have Phase 0 rewrite helper scripts into it from the prior plan's cited line spans.
+- An identity sweep that runs before the commit must read `git diff <base>` added lines (merge base vs working tree) plus every `git ls-files --others --exclude-standard` file; after the commit run the same script over `<base>...HEAD` and report it in the return message (no file, so the tree stays clean). Tokens: leaf of `$env:USERPROFILE`, 8.3 short form from `$env:TEMP`, `$env:COMPUTERNAME`, `git config user.email`; controls: synthetic `x<token>y` per token and the worktree `.git` pointer file.
+- To reproduce a duplicate `WrittenPath` in `Repair-PackageManifestConsistency.ps1`, split the `<assemblyBinding` start tag across two lines in a stale app.config fixture: the sync pass writes the redirect, then `ConvertTo-AppConfigText` collapses the tag and writes again. Guard with a sibling `It` proving both rewrites landed.
+- `Invoke-BindingRedirectReconciliation` already matches names case-insensitively, so a case-variant duplicate block only produced a redundant repair record; the regression test asserts the repair count, not the text.
+- Related: [[project-985-r0-rehearsal-fidelity-and-hygiene-path-seams]], [[runtime-derived-account-token-pattern]].
diff --git a/.claude/agent-memory/feature-review/MEMORY.md b/.claude/agent-memory/feature-review/MEMORY.md
index 59b7e3f80..c734a8019 100644
--- a/.claude/agent-memory/feature-review/MEMORY.md
+++ b/.claude/agent-memory/feature-review/MEMORY.md
@@ -108,86 +108,12 @@
 - [code-review findings table header](code-review-findings-table-header.md) — exact 7-column header
 - [code-review/feature-audit required headings](code-review-required-headings.md) — `## Executive Summary`, `## Findings Table`, `## Acceptance Criteria Inventory/Evaluation`
 
-## Closed-issue residuals (lookup only)
-- [review-residuals index](project_review-residuals-index.md) — one-line pointers for #442-#942 (incl. #930 AC7 host-path PARTIAL; #942 `.csproj` disarms the C# hook check)
-- [973](project_973-review-residuals.md) — REMEDIATION_REQUIRED 21/23 (AC17 premise defect = autonomous spec amendment; AC18 manual); split-coverage arithmetic from class-node fractions; bundled PoshQC FAIL row + vacuous PASS; PS JaCoCo epoch is local-as-UTC
+
+## Closed-issue residuals (lookup only; details in the residuals index)
+- [review-residuals index](project_review-residuals-index.md) — per-issue summaries #442-#968 (#930 host-path PARTIAL; #942 `.csproj` disarms C# hook check)
+- [985](project_985-review-residuals.md) — cycle 1 blocker: account name in encoded scratchpad dir; cycle 2 PASS; hook sim param is `-RawPayload`
+- [973](project_973-review-residuals.md) — AC premise defect = autonomous spec amendment; bundled PoshQC FAIL row + vacuous PASS
 - [438](project_438_cycle1_findings.md) · [440](project_440-review-residuals.md) · [441](project_441-review-residuals-and-494-handoff.md) · [457](project_457-review-residuals.md) · [464](project_464-review-residuals.md) · [489](project_489-review-residuals.md) · [493](project_493-review-residuals-and-msbuild-log-gate-adjudication.md) · [511](project_511-rescope-review-residuals.md) · [553](project_553_ci_split_review_pattern.md) · [565](project_565-review-residuals.md) · [584](project_584-review-residuals.md)
 - [644](project_644-review-residuals.md) · [645](project_645-review-residuals.md) · [647](project_647-review-residuals.md) · [677](project_677-review-residuals.md) · [680](project_680-review-residuals.md) · [707](project_707-review-residuals.md) · [730](project_730-review-residuals.md) · [731](project_731-review-residuals.md) · [735](project_735-review-residuals.md) · [736](project_736-review-residuals.md) · [751](project_751-review-residuals.md)
-- [752](project_752-review-residuals.md) (scope lock doesn't discharge host-path sweep) · [781](project_781-review-residuals.md) · [791](project_791-review-residuals.md) · [799](project_799-review-residuals.md) · [826](project_826-review-residuals.md) · [287](project_287-review-outcome.md) · [928](project_928-review-residuals.md) (cycle 1: AC6 uncredited line; exit: PASS 7/7 after part-file relocation; no-Bash review reads gitignored JaCoCo `<sourcefile>` nodes directly; 3-`..` hook path; P-4 bundled PoshQC coverage never covers `scripts/`) · [929](project_929-review-residuals.md) (PASS 7/7, 0 blocking; AC met by tests of a pre-existing rule accepted; labels led UTC clock 38-72 min; `.bak` residue = follow-up) · [944](project_944-review-residuals.md) (PASS 18/18, 0 blocking; keyed TryRemove safe under single-writer-under-lock; Cobertura root epoch as no-shell clock; 3 follow-ups owed) · [945](project_945-review-residuals.md) (PASS 8/8, 0 blocking; attribute-exempt overloads, per-file 24/25 as new-code figure; SortEmail.cs 1454-line pre-existing breach) · [940](project_940-review-residuals.md) (PASS 8/8, 0 blocking; per-file coverage ruling verified at Cobertura `<class>` nodes; worktree `logs/HEAD` reflog epochs as no-shell clock; stale session-cwd coverage.xml handled with an honest FAIL line; 3 follow-ups owed) · [947](project_947-review-residuals.md) (PASS 7/7, 0 blocking; empty `catch (Exception)` around a sink accepted via the SafeLog precedent; third unguarded sink `_notifyUnavailable` owed as follow-up; 5 follow-ups) · [956](project_956-review-residuals.md) (PASS 17/17, 0 blocking; partial split + prompt-session seam; Cobertura `<class>` Grep must key on `filename=`; stale session coverage.xml is Cobertura so the hook's JaCoCo parse is null; DirectoryInfo-inside-try spec inconsistency CR-1) · [948](project_948-review-residuals.md) (PASS 16/16, 0 blocking; lock-free check-then-record safe via marker serialisation; record-after-sink inside the #947 try; Glob hides git-ignored files, Grep/Read the exact path; Cobertura epoch 63 min behind labels; no-Bash review) · [968](project_968-review-residuals.md) (AWAITING_CI 31/32; caller-classed pending AC = one awaiting_ci blocker + remediation-inputs; hook-safe policy-audit wording validator-confirmed; five-`..` path from TaskMaster-wt cwd; session-checkout copies as pre-change text) · [950](project_950-review-residuals.md) (PASS 16/17, AC17 PENDING CI by ruling, 0 blocking; attribute-excluded production file = PASS on no-regression limb + execution proof via seam-removal NRE controls; theme-test null-dispatcher exposure counted not found; hook-safe zero-file wording; reflog clock) · [964](project_964-review-residuals.md) (cycle 0 PASS 8/8 then cycle-1 exit PASS 8/8, 0 blocking; a pure-move split isolated a pre-existing uncovered arm into a new partial reading 50% branches: non-blocking Minor, closed by one data-driven test with the class node moving 0.5->1 at the same XML line; executor composed-then-re-stamped Timestamps = Minor non-blocking P-1, count the note by Grep; caller-supplied review labels disclosed; wrapped XML-doc phrases defeat line Grep)
-- [959-review-residuals](project_959-review-residuals.md) — cycle 1 + cycle 2 (post Phase 7) both PASS 25/27, 0 blocking; CR-1/CR-3 closure read at the Cobertura line node; overwritten projections hide a 1-branch repo-wide drift (observe, don't gate); check the plan Status line vs task boxes after an in-place phase append (CR-8)
-- [Never embed absolute host paths](../_shared_no_absolute_host_paths.md) — no account/host names in artifacts; use `<repo-root>`/`<user>`/`<host>`; vstest TRX defaults to `<account>_<HOST>_<ts>.trx`, control `/ResultsDirectory:`
-- [don't trust "unreachable" on a coverage-escape set](feedback_dont-trust-the-unreachable-label-on-a-coverage-escape-set.md) — check each member of U against the BASELINE Cobertura; `hits>0` before means it was never unreachable
-- [565-review-residuals](project_565-review-residuals.md) — PASS/0, 6/6; a concurrent reviewer committed into the same worktree mid-audit with a future-dated ts
-- [584-review-residuals](project_584-review-residuals.md) — ACCEPT/0, 7/7; a public static has THREE read routes (qualified, reflective, `using static`) — census all three
-- [731-review-residuals](project_731-review-residuals.md) — PASS/0 blocking 19/19; caller's own deferral framing was wrong; CSharpier forces a blank line above an inserted comment
-- [735-review-residuals](project_735-review-residuals.md) — PASS/0, 24/25; latent `_primeTasks.TryRemove` outside `_primeGate`
-- [736-review-residuals](project_736-review-residuals.md) — PASS/0, 11 PASS + 2 PARTIAL of 13; D2 escape precondition true but U mislabelled; `Application.OpenForms` is app-domain-wide
-- [751-review-residuals](project_751-review-residuals.md) — PASS/0, 10/10; exactly-one-`.coverage` is unsatisfiable under `/InIsolation`; recover via `dotnet-coverage merge`
-- [const-string JS bridge files have zero Cobertura lines](project_const-string-js-bridge-files-zero-cobertura-lines.md) — #737: absence is correct signal for const-only assets, not a gap
-- [Pester counts commands, not lines](project_pester-line-coverage-node-appears-only-with-an-analyzable-command.md) — a line holding only an `-and` operand gets NO JaCoCo node; adding a call makes it appear covered (802->803 confirms)
-- [policy-audit-template MCP unavailable](project_policy-audit-template-mcp-unavailable-737.md) — #737: hand-author preserving the 12 canonical headings, don't mark fully BLOCKED
-- [YAML comment-only diff proof](project_yaml-comment-only-diff-proof-via-parse-tree.md) — a deeper-indented comment can fold into a plain scalar; prove via parse-tree compare, 2 parsers
-- [799-review-residuals](project_799-review-residuals.md) - PASS/0, 8/8; an escalate-if-X precondition in a spec is checkable in code; session-root pr_context belonged to a DIFFERENT cohort item
-- [ExcludeFromCodeCoverage ruling](project_excludefromcodecoverage-attribute-ruling.md) - Not Blocking: CLAUDE.md is L1; the rules Blocking clause covers config `exclude` globs, not attributes
-- [707-review-residuals](project_707-review-residuals.md) - PASS/0; executor self-caught a stale merge-base; AC9 literal-text gap disclosed; async Cobertura delta > raw diff lines
-- [730-review-residuals](project_730-review-residuals.md) - closed c2; sanitization scoped to a file list missed an earlier doc; sanitize-after-commit leaves a blob -> squash-merge
-- [pr_context artifacts are TRACKED](project_pr-context-artifacts-are-tracked-not-gitignored.md) - main carries a stale pair from another feature; derive from git, record the deviation
-- [three-dot degenerates when base is an ancestor](project_three-dot-degenerates-when-base-is-ancestor.md) - #735: after a 2nd main merge `X...HEAD` becomes `X..HEAD`; re-derive `merge-base`
-- [752-review-residuals](project_752-review-residuals.md) - 6/6 AC, 1 blocking: an executor Write-Set scope lock does not discharge the branch-level host-path obligation; re-sweep the diff yourself
-- [645-review-residuals](project_645-review-residuals.md) - 10/10 AC, 1 blocking; committed Cobertura leaks the account name 2007x via `filename=` attrs
-- [DoNotParallelize census misses lazy-init writers](project_donotparallelize-census-misses-lazy-init-writers.md) - a bare underscore-field grep finds only test writers; sibling lazy-init properties reach the production writer
-- [nullable-remediation-epic-review-pattern](project_nullable-remediation-epic-review-pattern.md) — recurring checks for the utilitiescs-nullable-remediation epic's 12 Wave children (#363+): epic-integration diff base, per-file #nullable enable, net481 constraints, solution-wide gate fails on pre-existing non-nullable warnings (use per-project AC1 proof)
-- [gitignore-tracking-expands-diff-scope](project_gitignore-tracking-diff-scope.md) — un-ignoring `.claude/` makes the whole subtree show as added in the branch diff; audit scope must cover those files, not the plan's "single file" claim
-- [powershell-coverage-mandatory-when-ps1-in-diff](feedback_powershell-coverage-gate.md) — validate-feature-review-coverage hook blocks termination without an explicit PASS/FAIL PowerShell coverage verdict when .ps1 files changed
-- [pr-context-summary-misclassifies-cs](project_pr-context-summary-misclassifies-cs.md) — PR-context summary overview can mislabel C# changes as docs ("0 core logic files"); always verify scope against git diff
-- [coverage-hook-trusts-misclassified-summary](project_coverage-hook-trusts-misclassified-summary.md) — the coverage hook reads changed languages from the summary overview, not git diff; a C#-as-docs misclassification makes it silently skip C# coverage enforcement
-- [csharp-coverage-artifact-is-cobertura](project_csharp-coverage-artifact-is-cobertura.md) — `artifacts/csharp/coverage.xml` is Cobertura; the hook parses it as JaCoCo and gets $null repo-wide, so the reviewer must parse it manually
-- [csharp-local-fullsuite-coverage-blocked](project_csharp-local-fullsuite-coverage-blocked.md) — local full-assembly C# coverage fails on a Moq binding redirect; per-feature Cobertura is trimmed to affected classes (no repo-wide root), so repo-wide gate is the PR CI run
-- [csharp-repowide-coverage-below-80](project_csharp-repowide-coverage-below-80.md) — raw all-DLL Cobertura merges read ~59-69% (vendor-inflated denominator); canonical first-party figures (Koverage ~79.4%, or manual by-name package exclusion ~91.22% per #253) both clear 80%/85%
-- [feature-audit check-off heading case](feature-audit-checkoff-heading-case.md) — validator needs `## Acceptance Criteria Check-off` (lowercase off); template ships `Check-Off` and fails
-- [feature-audit requires Summary heading](feature-audit-requires-summary-heading.md) — validator also needs a literal `## Summary`; `## Verdict` alone fails
-- [policy-audit required structure](policy-audit-required-structure.md) — validator needs Appendix A heading, all 4 TS/PS coverage checklist lines, and a numeric Baseline/Post-change/Disposition comparison line
-- [code-review findings table header](code-review-findings-table-header.md) — code-review validator requires the exact 7-column `| Severity | File | Location | Finding | Recommendation | Rationale | Evidence |` header
-- [code-review/feature-audit required headings](code-review-required-headings.md) — code-review needs `## Executive Summary` + `## Findings Table`; feature-audit needs `## Acceptance Criteria Inventory` + `## Acceptance Criteria Evaluation` (exact text)
-- [policy-audit comparison-line schema](policy-audit-comparison-line-schema.md) — per-language bullets under `### 1.2.1` need labelled `Baseline:` `Post-change:` `Change:` `Disposition:` `Evidence:` (and `New/changed-code coverage:` when row is non-N/A)
-- [policy-audit validator uses full template](policy-audit-validator-uses-full-template.md) — THIS repo's validator needs the full bundled template headings (`## Executive Summary` + `## 1`..`## 7`); resolve the MCP template asset and fill it in
-- [PowerShell line-count undercount](powershell-measure-object-line-undercount.md) — `(Get-Content | Measure-Object -Line).Lines` undercounts vs `awk NR`/`wc -l`
-- [policy-audit section-7 row-label parser](policy-audit-section7-row-label-parser.md) — validator misreads non-standard section-7 Code-Quality row labels as coverage rows; reuse cycle-1 wording, no comma qualifiers in label cell
-- [numeric new/changed-code coverage + Scope-and-Baseline](policy-audit-numeric-new-code-coverage.md) — policy-audit new-code-coverage field must be a literal percent (prose fails); feature-audit needs a `## Scope and Baseline` heading
-- [test files count toward 500-line limit](feedback_test-file-500-line-limit.md) — compare changed test files' baseline vs head line count; a regression-test addition crossing 500 lines is a FAIL-level policy finding even when ACs pass
-- [koverage analyzer finding misattributed](project_koverage-analyzer-finding-misattributed.md) — the pre-existing PSUseSingularNouns in Invoke-MSTestWithCoverage.Helpers.ps1 is on Get-CoberturaLineConditionCoverageParts, not Merge-CoberturaClassesByFilename as issue/evidence claim
-- [projectentry-setter-raw-messagebox-blocks-coverage](project_projectentry-setter-raw-messagebox-blocks-coverage.md) — #199 ProjectEntry change-confirmation is uncoverable via MyBox seam (commit runs the ProjectID setter's RAW MessageBox.Show); spec AC1 "fully covered by Phase 5" is overstated
-- [msbuild-invocation-via-bash](project_msbuild-invocation-via-bash.md) — msbuild/vstest not on bash PATH; `Platform="Any CPU"` needs a `/tmp` .cmd wrapper (`AnyCPU` and bash-quoted space both fail); a 127 exit is not a passing step
-- [TestResults coverage XML cross-module check](project_testresults-coverage-xml-cross-module-check.md) — an uncommitted `TestResults/*.xml` from a single-project vstest run also instruments other loaded first-party modules; grep it to spot-check a "repository coverage" claim without rerunning coverage
-- [plan trailer preflight directive is benign](project_plan-trailer-preflight-directive-benign.md) — a trailing `DIRECTIVE: PREFLIGHT VALIDATION ONLY` line in plan.md is standard planner/executor handoff text, not an injection aimed at feature-review; don't flag it as scope narrowing
-- [feature-evidence Cobertura counts as the C# coverage artifact](project_feature-evidence-cobertura-counts-as-coverage-artifact.md) — #424: committed `<FEATURE>/evidence/` Cobertura = artifact present; verify from it, don't repeat #309's procedural FAIL; dot-source the hook for end-to-end simulation
-- [TaskMaster validator memories are cross-repo](project_taskmaster-validator-memories-are-cross-repo.md) — the `validate_orchestration_artifacts`/heading-template memories describe a different repo (mix-calculator/drm-copilot); TaskMaster's only real gate is `validate-feature-review-coverage.ps1` (3-path advertisement + per-language coverage-row PASS/FAIL/no-narrowing check)
-- [Stale caller-supplied merge-base](project_stale-caller-merge-base.md) — #244 cycle 2: caller SHA was one merged PR behind actual `main`; always recompute via `git merge-base HEAD origin/main`, don't trust the supplied value
-- [modified-workflow green-run gate is manual](project_modified-workflow-green-run-manual-check.md) — #267: Test-ModifiedWorkflowNeedsGreenRun.ps1 doesn't exist in TaskMaster; check via `git diff --name-only` for `.github/workflows/**`, not the summary's truncated top-10 overview bullets
-- [same-commit differing-outcome flake check](project_same-commit-differing-outcome-flake-check.md) — #261 cycle 1: two evidence runs at the identical SHA disagreeing on one test's outcome proves environment-flake, not regression; corroborate "pre-existing failure" claims this way before writing PASS
-- [PR-context MCP unavailable, manual fallback](project_pr-context-mcp-unavailable-manual-fallback.md) — #269: no collect_pr_context tool in-session; hand-author pr_context.summary.txt from `git diff --numstat` in the hook's bullet format so Get-ChangedLanguageSet still fires; paths with spaces break that regex per-line
-- [C# coverage: convert raw .coverage when canonical XML absent](project_csharp-coverage-independent-verification-via-raw-coverage-conversion.md) — #278: `dotnet-coverage merge -f cobertura` on the executor's own `TestResults/*.coverage` gives independent per-line verification without rerunning tests
-- [coverage hook forces FAIL below 85% even with exemption](coverage-hook-forces-fail-below-floor-despite-exemption.md) — #283: below-floor language row must read "FAIL, dispositioned non-blocking via exemption" not PASS; C# Cobertura reads $null (skipped); re-added summary lines need `(+N/-N)` format or C# is skipped
-- [coverage hook label regex matches substrings](project_coverage-hook-label-substring-false-positive.md) — #309/#354 R4: any language's label word (not just "csharp"/"dotnet") plus "coverage" plus a narrowing phrase on one line trips a false FAIL, including inside the boilerplate `## Rejected Scope Narrowing` paragraph; simulate the hook's regex (or the full validator) against the draft before finalizing
-- [deletion-only PR with absent canonical C# artifact](project_deletion-only-pr-absent-coverage-artifact-309.md) — #309: pure-deletion, zero-new-files PR still gets FAIL C# coverage verdict per mandatory artifact-absence rule even though feature-evidence Cobertura shows the touched module (88.19%→88.23%) clears floor with zero regressions; disposition as procedural remediation, not a code defect
-- [canonical JaCoCo includes un-instrumented assemblies](project_csharp-canonical-jacoco-includes-uninstrumented-assemblies.md) — #328: a canonical artifacts/csharp/coverage.xml aggregating first-party assemblies whose .Test project wasn't in the collection reads ~0% (unmeasured) and unconditionally blocks termination via the sub-75% branch check; re-scope to instrumented assemblies from the fixed Cobertura
-- [durable feature-script triggers Python coverage gate](project_durable-feature-script-triggers-python-coverage-gate.md) — #354: a one-off audit script copied into `<FEATURE>/scripts/*.py` per the durable-script convention is still a committed `.py` file; mandatory coverage gate applies, no exemption for feature-folder tooling
-- [SVGControl stale binding redirect out of scope](project_svgcontrol-stale-binding-redirect-out-of-scope.md) — #354: `SVGControl/app.config`'s `System.Runtime.CompilerServices.Unsafe` redirect (6.0.2.0 vs csproj 6.0.3.0) is still stale as of 2026-07-18; check it in any future app.config binding-redirect audit
-- [pr-context stale after remediation commit](project_pr-context-stale-after-remediation-commit.md) — #354 R4: pr_context artifacts don't auto-update after a remediation commit lands; compare `git rev-parse HEAD` against the summary's recorded Head ref every re-audit cycle and refresh if stale
-- [partial remediation still fails new-code floor](project_partial-remediation-new-code-floor-still-fails-209.md) — #209 R4: extracting one testable seam from a native-engine adapter raised coverage 0%->7.7%, real progress but still far below 85%/90%; recompute against the actual floor, don't trust a remediation-plan's weak ">0%" acceptance bar; recommend a maintainer exemption decision when the residual is architecturally irreducible
-- [nullable-epic full-solution TWAE is pre-existing](project_nullable-epic-fullsolution-twae-preexisting-blocker.md) — #364: utilitiescs-nullable-remediation children's plan-literal full-solution pragma-only TWAE build exits 1 on pre-existing out-of-scope SVGControl CS0649 + EmailIntelligence/Extensions CS0618; adjudicate DoD "toolchain passes" via the isolated UtilitiesCS.csproj build (EXIT 0, 0 CS86xx), not blocking
-- [coverage hook skips when no pr_context.summary.txt](coverage-hook-skips-when-no-pr-context-summary.md) — #367: absent pr_context summary makes changedLanguages empty, so the hook runs only the 3 artifact-path/location checks and skips all per-language coverage-row enforcement; still write clean PASS/FAIL rows; evidence/qa-gates/ is an allowed audit-artifact path
-- [ScoDictionaryNew swap: enumeration order + removal API](project_scodictionary-new-enumeration-order-and-removal-api.md) — swordfish-removal epic (F1 #306..F5): swap silently changes insertion->concurrent enumeration order (needs tie-breaks) and .Remove->.TryRemove in consumers; Static.Deserialize+Serialize() only, never the globals converter path; no SerializeAsync
-- [epic-child-twodot-diff-divergence-noise](project_epic-child-twodot-diff-divergence-noise.md) — reviewing an epic child vs the integration branch: use three-dot merge-base diff or sibling merges show as spurious adds/deletes (#307)
-- [rescoping to instrumented package doesn't always clear floor](project_rescoping-to-instrumented-package-does-not-always-clear-floor.md) — #392: unlike #328's StoresWrapper win, QuickFiler's own instrumented-package figure (73.68%/64.62%) is itself pre-existing sub-floor; always re-check against the floor after rescoping instead of assuming it always rescues the number
-- [orchestrator-state human_interaction verifies scope_change ratification](project_orchestrator-state-human-interaction-verifies-scope-change-ratification.md) — #392 R4: cross-check a feature-evidence "maintainer ratified this" claim against the actual `human_interaction.requirements` block in `artifacts/orchestration/orchestrator-state.json` (gitignored, not in the diff) before downgrading a sub-floor FAIL to non-blocking
-- [stale untracked coverage.xml leftover false-blocks the hook](project_stale-untracked-coverage-xml-leftover-false-block.md) — #398: an untracked stale `artifacts/csharp/coverage.xml` from an earlier worktree session pre-populates the canonical path and unconditionally trips the sub-75 branch block once C# is enumerated; remove it (yields $null) so an honest FAIL-procedural row passes; simulate the hook before finalizing
-- [vstest argument order + missing transitive dep](project_vstest-argument-order-transitive-dep.md) — #418: legacy packages.config projects don't flow transitive copy-local, so a test assembly passes/fails by its ordinal position on the vstest command line; always run a changed test assembly ALONE, the 9-assembly wrapper hides it
-- [LangVersion-less test projects emit CS8630](project_langversion-missing-test-projects-cs8630.md) — #418: 6 test projects default to C# 7.3 so `/p:Nullable=enable` fails; the mandated solution gate returns 0 only because it's a 1.7s no-op (0 CoreCompile) — force-rebuild the changed project alone, and never `/t:Rebuild` anything depending on UtilitiesCS
-- [remediation-handoff skill layout conflicts with the hook](project_remediation-handoff-skill-conflicts-with-hook.md) — the skill's `audit/<ts>/policy-audit.md` layout fails the hook regex; use the flat timestamped form, let atomic-planner author the plan, and note which validator scripts/MCP tools simply don't exist in TaskMaster
-- [verify parity claims in remediation inputs](feedback_verify-parity-claims-in-remediation-inputs.md) — #418: my "parity with the eight sibling test projects" Fizzler directive was false on disk and the executor rightly refused; measure every parity claim, and check app.config redirect vs on-disk package version
-- [verify the asserted evidence mechanism](feedback_verify-asserted-evidence-mechanism.md) — #418 R4: a capture's "proven by unit tests" was false (zero Trace/log4net refs in the test project); 100% coverage on a logging member is not assertion — grep the mechanism, correct the basis, keep the PASS
-- [maintainer waiver hides in gitignored state](project_maintainer-waiver-recorded-only-in-gitignored-state.md) — #418 R4: coverage waivers land in the gitignored orchestrator-state.json and never reach the PR; run `git check-ignore`, require transcription into issue.md, and never convert a threshold waiver into an ExcludeFromCodeCoverage exclusion
-- [Write-Verbose remedy is inert](feedback_write-verbose-remedy-is-inert-without-a-verbose-call-site.md) — needs -Verbose at the deployed call site
-- [re-audit cycle playbook](project_re-audit-cycle-review-playbook.md) — split remediable blockers from PR-time gates; re-anchor a moved merge base
-- [927-review-residuals](project_927-review-residuals.md) — PASS/0, 17/20 + 3 PENDING-CI; -0.01pp C# noise with zero prod change; `*cobertura*.xml` ignores the default projection stem; bundled PoshQC artifact lacks scripts/hygiene; 7-cell trap applies to every table
+- [752](project_752-review-residuals.md) · [781](project_781-review-residuals.md) · [791](project_791-review-residuals.md) · [799](project_799-review-residuals.md) · [826](project_826-review-residuals.md) · [287](project_287-review-outcome.md) · [927](project_927-review-residuals.md) · [928](project_928-review-residuals.md) · [929](project_929-review-residuals.md) · [940](project_940-review-residuals.md) · [944](project_944-review-residuals.md)
+- [945](project_945-review-residuals.md) · [947](project_947-review-residuals.md) · [948](project_948-review-residuals.md) · [950](project_950-review-residuals.md) · [956](project_956-review-residuals.md) · [959](project_959-review-residuals.md) · [964](project_964-review-residuals.md) · [968](project_968-review-residuals.md)
diff --git a/.claude/agent-memory/feature-review/project_985-review-residuals.md b/.claude/agent-memory/feature-review/project_985-review-residuals.md
new file mode 100644
index 000000000..e14a4647f
--- /dev/null
+++ b/.claude/agent-memory/feature-review/project_985-review-residuals.md
@@ -0,0 +1,17 @@
+---
+name: 985-review-residuals
+description: '#985 (borrowed test packages + solution-wide binding-redirect sync) cycle 1 2026-10-09T14-55 REMEDIATION_REQUIRED (account name in encoded scratchpad dir); cycle 2 2026-10-09T15-35 PASS, 0 blocking, AC7 pending CI; hook simulation needs -RawPayload'
+metadata:
+  type: project
+---
+
+Cycle 1 (head de397b992, base 9911fe138): REMEDIATION_REQUIRED, 1 blocking (B-1 autonomous: account name inside encoded session-scratchpad dir name in the committed plan). Cycle 2 (head 07d3a8a98, review 2026-10-09T15-35): PASS, 0 blocking, AC1-6 PASS, AC7 PENDING CI; R1 also fixed CR-1 (Direction field), CR-2 (WrittenPath de-dup), CR-3 (case-insensitive handled set) in scope.
+
+**Reusable points:**
+- Host-identifier sweep must include ENCODED forms: the scratchpad name `C--Users-<account>-repos-...` carries the account name. Sweep added lines for the bare account name, its 8.3 short form, host, both e-mails, plus a drive-rooted users regex; use the `.git` pointer file as a positive control. Precedent [[752-review-residuals]] makes it blocking.
+- `validate_orchestration_artifacts` (policy-audit) FAILS with "cannot report PASS or READY when resolve_policy_audit_template_asset is reported as missing or not exposed" if a section names that tool as unavailable. Use a neutral `## Template Provenance` section instead.
+- Hook simulation: dot-source `.claude/hooks/validate-feature-review-coverage.ps1` and call `Invoke-FeatureReviewCoverageValidation -RawPayload (@{output=...}|ConvertTo-Json)` (parameter is `-RawPayload`, not `-HookInput`). Bundled PoshQC artifact again 0/10477 -> explicit FAIL line plus PASS line, per [[poshqc-bundled-coverage-artifact-reads-zero]].
+- A re-audit where R1 touched no C#-family file may carry cycle-0 C# evidence forward; cite the executor's not-applicable proof and confirm with `git show --stat <R1 sha>`.
+- Direct Pester run (New-PesterConfiguration over tests/scripts/{dependencies,hygiene,vscode}, coverage scripts/{...}) reproduced the executor figures exactly (447, 94.99%, 1898/1998) in ~1-2 min.
+
+**Follow-ups owed:** rehearsal worktree `rehearsal-985-throwaway` cleanup (still present at cycle 2); workflow comment drift promoted to #986; remediation-plan status line stale ("Draft").
diff --git a/.claude/agent-memory/feature-review/project_review-residuals-index.md b/.claude/agent-memory/feature-review/project_review-residuals-index.md
index 4c8db472d..04b690ea9 100644
--- a/.claude/agent-memory/feature-review/project_review-residuals-index.md
+++ b/.claude/agent-memory/feature-review/project_review-residuals-index.md
@@ -139,3 +139,19 @@ not the full record.
   85.33/79.71 -> 85.36/79.75; TrySave class 63/66 with exactly L49/L154/L155 at 0 hits (coordinator-ruled
   exemptions, reviewer concurred); session 20/20. Details and the Cobertura-Grep attribute-order lesson in
   [[956-review-residuals]].
+
+## Moved from MEMORY.md on 2026-10-09 (index size consolidation)
+
+- **#928**: cycle 1 AC6 uncredited line; exit PASS 7/7 after part-file relocation; no-Bash review reads gitignored JaCoCo `<sourcefile>` nodes; 3-`..` hook path; bundled PoshQC coverage never covers `scripts/`. [[928-review-residuals]]
+- **#929**: PASS 7/7; AC met by tests of a pre-existing rule accepted; labels led UTC clock 38-72 min; `.bak` residue follow-up. [[929-review-residuals]]
+- **#940**: PASS 8/8; per-file coverage ruling verified at Cobertura `<class>` nodes; worktree reflog epochs as no-shell clock; stale session-cwd coverage.xml handled with an honest FAIL line. [[940-review-residuals]]
+- **#944**: PASS 18/18; keyed TryRemove safe under single-writer-under-lock; Cobertura root epoch as clock. [[944-review-residuals]]
+- **#945**: PASS 8/8; attribute-exempt overloads, per-file 24/25 as new-code figure; SortEmail.cs 1454-line pre-existing breach. [[945-review-residuals]]
+- **#947**: PASS 7/7; empty `catch (Exception)` around a sink accepted via SafeLog precedent; `_notifyUnavailable` follow-up. [[947-review-residuals]]
+- **#948**: PASS 16/16; lock-free check-then-record safe via marker serialisation; Glob hides git-ignored files. [[948-review-residuals]]
+- **#950**: PASS 16/17, AC17 PENDING CI by ruling; attribute-excluded production file PASS on no-regression limb. [[950-review-residuals]]
+- **#959**: cycles 1 and 2 PASS 25/27; overwritten projections hide a 1-branch repo-wide drift; check plan Status line vs task boxes (CR-8). [[959-review-residuals]]
+- **#964**: PASS 8/8 both cycles; pure-move split isolated a pre-existing uncovered arm (non-blocking Minor). [[964-review-residuals]]
+- **#968**: AWAITING_CI 31/32; caller-classed pending AC = one awaiting_ci blocker; hook-safe wording validator-confirmed. [[968-review-residuals]]
+- **#927**: PASS 17/20 + 3 PENDING-CI; -0.01pp C# noise with zero prod change; 7-cell trap applies to every table. [[927-review-residuals]]
+- Older one-liners (#565, #584, #645, #707, #730, #731, #735, #736, #751, #752, #799): see each `project_<N>-review-residuals.md`.
diff --git a/.claude/agent-memory/task-researcher/MEMORY.md b/.claude/agent-memory/task-researcher/MEMORY.md
index 8c65c2e8c..f0798a91b 100644
--- a/.claude/agent-memory/task-researcher/MEMORY.md
+++ b/.claude/agent-memory/task-researcher/MEMORY.md
@@ -1,19 +1,36 @@
 # Task Researcher Memory Index
 
+## Sub-indexes
+- [epic136-percoverage-children](index_epic136_percoverage_children.md) — 35 QuickFiler/EFC per-file coverage child notes (430-495, 227)
+- [quickfiler-efc-defects](index_quickfiler_efc_defects.md) — 40 QuickFiler/EFC/SortEmail defect and behaviour notes
+
 ## Hygiene, feedback, references
 - [no-absolute-host-paths](../_shared_no_absolute_host_paths.md) — use `<repo-root>`/`<user>`/`<host>`; rename TRX before citing
-- [no-absolute-host-paths](../_shared_no_absolute_host_paths.md) — use `<repo-root>`/`<user>`; rename TRX before citing
-- [exemption-audit-proven-techniques](feedback_exemption_audit_check_proven_techniques.md) — grep proven techniques before IRREDUCIBLE
-- [measure-item-worktree](feedback_measure_item_worktree_not_session_worktree.md) — measure the item worktree, not the session one
-- [committed-cobertura-baselines](reference_committed_cobertura_baselines.md) — per-line coverage in docs/features/*/evidence
-- [net481-timeprovider](reference_net481_timeprovider_available.md) — FakeTimeProvider usable on net481
+- [exemption-audit-proven-techniques](feedback_exemption_audit_check_proven_techniques.md) — grep proven techniques + sibling consistency before IRREDUCIBLE
+- [measure-item-worktree](feedback_measure_item_worktree_not_session_worktree.md) — read facts from the ITEM worktree; uniform off-by-N = stale tree
+- [committed-cobertura-baselines](reference_committed_cobertura_baselines.md) — per-line coverage in docs/features/*/evidence/*.cobertura.xml
+- [net481-timeprovider](reference_net481_timeprovider_available.md) — FakeTimeProvider usable on net481; reject "net8+ only"
 - [github-issue-search-without-gh](reference_github_issue_search_without_gh.md) — WebFetch issues?q=...; mark [V-web]
-- [nuget-flatcontainer-nuspec-webfetch](reference_nuget_flatcontainer_nuspec_webfetch.md) — packages/ has no .nuspec; fetch api.nuget.org flat-container nuspec
+- [nuget-flatcontainer-nuspec](reference_nuget_flatcontainer_nuspec_webfetch.md) — packages/ has no .nuspec; fetch api.nuget.org flat-container nuspec
+
+## Dependencies / Dependabot / packages.config
+- [dependabot-repair-script-source-985](project_dependabot_repair_workflow_run_script_source_985.md) — repair runs branch's script; YAML edits can't green-run; redirect invariant is a union
+- [binding-redirect-drift-973](project_binding_redirect_drift_and_missing_asyncenumerable_973.md) — NuGet rewrites only installer's config; AsyncEnumerable aliased
+- [graph-usings-973](project_graph_usings_removable_and_models_name_collisions_973.md) — all 6 Graph usings removable; Models name collisions
+- [ixnet-v7-lib-ref-clash](project_ixnet_v7_lib_ref_clash_packages_config.md) — lib/net48 public AsyncEnumerable; global BCL ref = CS0121; use `<Aliases>`
+- [fsharp-hintpath-skew-895](project_fsharp_core_hintpath_skew_895.md) — 15 output dirs; ns2.1>2.0 ranking; ToDoModel.Test gap
+- [dependabot-net481-340](project_dependabot_net481_340.md) — semver-major ignore, no fabricated ceilings
+- [svgcontrol-test-418](project_svgcontrol_test_unwired_418.md) — STALE (in .sln since 2026-08-14)
 
 ## Threading / test determinism
-- [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult INLINES on pool thread
+- [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult on a pool thread INLINES
+- [taskrun-triage-931](project_taskrun_triage_931.md) — 2/22 Task.Run sites thread-dependent; OpenRead returns FileStream
+- [prime-marker-944](project_prime_marker_register_before_start_944.md) — ContinueWith(None) never inlines; TCS marker before start
+- [engine-toggle-prime-log-order-942](project_engine_toggle_prime_fault_log_order_942.md) — CompletePrime removes marker BEFORE log
+- [engine-toggle-fault-suppression-948](project_engine_toggle_fault_suppression_948.md) — pressed cache never clears; first fault can be NRE
+- [transactiongate-probe-882](project_transactiongate_parallel_safe_probe_882.md) — zero-bound probes assert only failure while holding
 - [pump-timeout-743](project_pump_timeout_743.md) — dispatcher-gate lead stale; TRX timestamps as instrument
-- [uithread-dispatcher-restore-493](project_uithread_dispatcher_restore_scope_493.md) — never one semaphore for helper+fixture
+- [uithread-restore-493](project_uithread_dispatcher_restore_scope_493.md) — never one semaphore for helper+fixture
 - [winforms-pump-seam-230](project_winforms_pump_seam_230.md) — WinFormsPumpHost; CreateAsync factory gap
 - [onedrive-timeout-253](project_onedrive_timeout_test_determinism_253.md) — catches TimeoutException not TCE
 - [unobserved-task-fault-670](project_unobserved_task_fault_670.md) — ViewerSetup.cs 499/500; raw WPF Dispatcher
@@ -22,38 +39,6 @@
 - [analyzer-severity-runsettings](project_analyzer_severity_ceiling_and_runsettings_split.md) — MSTEST0032 only rule above suggestion
 - [lock-recursion-317](project_lock_recursion_coverage_317.md) — deleted LockRecursionTests.cs is a restoration
 - [gettableinviewasync-838](project_gettableinviewasync_null_contract_838.md) — `maxAttempts:1` = TWO attempts; OCE is not TCE
-- [engine-toggle-fault-suppression-948](project_engine_toggle_fault_suppression_948.md) — pressed cache never clears; first fault can be NRE
-- [no-absolute-host-paths](../_shared_no_absolute_host_paths.md) — use `<repo-root>`/`<user>`/`<host>`; rename vstest TRX before citing
-- [measure-item-worktree](feedback_measure_item_worktree_not_session_worktree.md) — measure the item worktree, not the session worktree
-- [exemption-audit-check-proven-techniques](feedback_exemption_audit_check_proven_techniques.md) — grep proven techniques + sibling consistency before IRREDUCIBLE
-- [committed-cobertura-baselines](reference_committed_cobertura_baselines.md) — per-line coverage in docs/features/*/evidence/*.cobertura.xml; read, don't infer
-- [net481-timeprovider-available](reference_net481_timeprovider_available.md) — FakeTimeProvider usable on net481; reject "net8+ only"
-- [github-issue-search-without-gh](reference_github_issue_search_without_gh.md) — WebFetch github issues?q=... when gh absent; mark [V-web]
-- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — PQ setting no var substitution; rg-vs-git deltas; basename gotcha
-- [push-down-claude-dir-149](project_push_down_claude_dir.md) — pushDownClaudeDir research (2026-04-16)
-- [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult on a pool thread INLINES; MSTest 4.4 bodies run inside Task.Run; CheckAccess = Thread identity
-- [pump-timeout-743](project_pump_timeout_743.md) — dispatcher-gate lead stale (#493); 9/19 pump tests skip the gate; TRX timestamps as instrument; finally runs LATE not never
-- [transactiongate-parallel-safe-probe-882](project_transactiongate_parallel_safe_probe_882.md) — zero-bound probes assert only failure while holding; success via production entry; no DoNotParallelize; SemaphoreFullException surfaces at holder's Dispose
-- [taskrun-triage-931](project_taskrun_triage_931.md) — 2/22 Task.Run sites thread-dependent; DispatchValue never reads _ownerThreadId; IFileInfo.OpenRead returns FileStream (no MemoryStream)
-- [exemption-audit-proven-techniques](feedback_exemption_audit_check_proven_techniques.md) — grep proven techniques + sibling consistency before IRREDUCIBLE
-- [engine-toggle-prime-fault-log-order-942](project_engine_toggle_prime_fault_log_order_942.md) — CompletePrime removes marker BEFORE log; H1 false; probe handle from inside the sink; NB-2 unpromoted
-- [measure-item-worktree](feedback_measure_item_worktree_not_session_worktree.md) — read facts from the ITEM worktree; uniform off-by-N = stale tree
-- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — rg-vs-git one-file deltas; `basename $USERPROFILE` wrong in Git Bash; PQ setting no var substitution
-- [evidence-identity-hygiene-sweep-927](project_evidence_identity_hygiene_sweep_927.md) — classify raw evidence by XML root (243/23/27/18); _pester.yml paths explicit; `<drive>:` placeholders
-- [push-down-claude-dir-149](project_push_down_claude_dir.md) — #149 pushDownClaudeDir research (2026-04-16)
-- [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult on a pool thread INLINES; MSTest 4.4 bodies run inside Task.Run
-- [pump-timeout-743](project_pump_timeout_743.md) — dispatcher-gate lead stale (#493); 9/19 pump tests skip the gate; TRX timestamps as instrument
-- [uithread-dispatcher-restore-scope-493](project_uithread_dispatcher_restore_scope_493.md) — 2-lock split; never one semaphore for helper+fixture; CI runs QuickFiler.Test serially
-- [winforms-pump-seam-230](project_winforms_pump_seam_230.md) — WinFormsPumpHost design; CreateAsync factory-seam gap
-- [onedrive-timeout-test-determinism-253](project_onedrive_timeout_test_determinism_253.md) — TimeOutTask overload catches TimeoutException not TCE; DI-seam fix
-- [onedrive-timeout-test-determinism-253](project_onedrive_timeout_test_determinism_253.md) — TimeOutTask overload catches TimeoutException not TaskCanceled
-- [unobserved-task-fault-670](project_unobserved_task_fault_670.md) — ViewerSetup.cs 499/500; IItemViewer.UiDispatcher is raw WPF Dispatcher
-- [filerqueue-consumer-unsound-633](project_filerqueue_consumer_unsound_633.md) — Consumer orphaned-item race; BackGroundMove tests vacuous
-- [terminal-hook-barrier-751](project_terminal_hook_barrier_751.md) — notify runs after terminal TrySet; `run.Terminal` is the barrier
-- [gettableinviewasync-null-contract-838](project_gettableinviewasync_null_contract_838.md) — `maxAttempts:1` = TWO attempts; OCE is not TCE
-- [analyzer-severity-and-runsettings-split](project_analyzer_severity_ceiling_and_runsettings_split.md) — MSTEST0032 only rule above suggestion; no .globalconfig
-- [lock-recursion-coverage-317](project_lock_recursion_coverage_317.md) — deleted LockRecursionTests.cs is a restoration
-- [gettableinviewasync-null-contract-838](project_gettableinviewasync_null_contract_838.md) — `maxAttempts:1` = TWO attempts; OCE is not TCE
 
 ## Coverage / Cobertura mechanics
 - [cobertura-closure-exemption-457](project_cobertura_closure_exemption_457.md) — exempt members emit NO `<method>`; async `d__` trap
@@ -76,210 +61,6 @@
 - [capstone-f16](project_quickfiler_capstone_f16_measurement.md) — `<sources>` discriminates raw vs post-processed
 - [f9-measurement-441](project_qfc_f9_measurement_441_and_designer_inheritance.md) — #441 corrupts per-file line-rate
 
-## Epic #136 per-file coverage children
-- [qfc-helper-classes-434](project_qfc_helper_classes_f4_434.md) — EmailMoveMonitor seam; explicit Compile Includes
-- [qfc-theme-cluster-434](project_qfc_theme_cluster_f4_434.md) — theme+layout tests-only
-- [qfc-viewerqueue-434](project_qfc_perfile_coverage_viewerqueue_434.md) — method-group sites forbid optional params
-- [qfc-keyboard-coverage-430](project_qfc_keyboard_coverage_430.md) — no IVT UtilitiesCS->QuickFiler.Test
-- [qfc-keyboard-actions-430](project_qfc_keyboard_actions_430.md) — KaStringAsync has no async/timer
-- [qfc-datamodel-436](project_qfc_datamodel_coverage_436.md) — type-scoped exclude hides 3 partials
-- [efcdatamodel-436](project_efcdatamodel_coverage_436.md) — EmailFiler Sort/Open non-virtual
-- [qfc-queueprocessing-436](project_qfc_queueprocessing_436.md) — missing FakeTimeProvider fails silently
-- [qfc-framebuilding-436](project_qfc_framebuilding_436.md) — Deedle not WinForms
-- [qfc-explorer-controller-435](project_qfc_explorer_controller_435.md) — DynamicProxyGenAssembly2 IVT location
-- [qfc-form-controller-435](project_qfc_form_controller_coverage_435.md) — UndoConsumer busy-spins; re-verify
-- [qfc-form-setup-disposal-435](project_qfc_form_controller_setup_disposal_435.md) — Cleanup idempotent
-- [duplicate-iqfcformcontroller-435](project_quickfiler_duplicate_iqfcformcontroller_435.md) — Interfaces copy is dead
-- [qfc-home-metrics-433](project_qfc_home_controller_metrics_433.md) — metrics consumer never runs
-- [qfc-home-iteration-433](project_qfc_home_controller_iteration_433.md) — #424 deadline leaked; Iterate dead
-- [qfc-home-coverage-433](project_qfc_home_controller_coverage_433.md) — LaunchAsync 0% structurally
-- [efc-home-deps-437](project_efc_home_controller_deps_437.md) — Production* statics vs ClassLevel hazard
-- [efc-home-coverage-437](project_efc_home_controller_coverage_437.md) — Timing.cs reads no clock
-- [efc-item-controller-452](project_efc_item_controller_452.md) — IItemViewer covers ~70% of viewer
-- [efc-form-controller-452](project_efc_form_controller_452.md) — ViewerQueueCore does NOT pool
-- [qfc-item-230-pump-seam](project_qfc_item_controller_230_pump_seam.md) — #230 root of 4 exemptions
-- [qfc-item-f10-453](project_qfc_item_controller_f10_coverage_453.md) — test files at 497/498 of 500
-- [qfc-item-f10-init-453](project_excludefromcodecoverage_lambda_leak.md) — 3/7 exemptions on DEAD members
-- [qfc-conversation-seam-453](project_qfc_conversation_seam_ratified_453.md) — exemption #227-ratified
-- [qfc-collection-controller-454](project_qfc_collection_controller_454.md) — `async public` defeats greps
-- [quickfiler-test-sta-ivt](project_quickfiler_test_sta_and_ivt.md) — manual STA infra exists
-- [qfc-dropdown-f13-455](project_qfc_breadcrumb_dropdown_f13_455.md) — async `throw;` brace unreachable
-- [qfc455-reentrant-dispose](project_qfc455_reentrant_dispose_seam.md) — disposal reentrancy opens async window
-- [qfc-itemviewer-456](project_qfc_itemviewer_coverage_456.md) — line-rate corrupt, branch-rate sound
-- [qfc-breadcrumb-lifecycle-495](project_qfc_breadcrumb_lifecycle_f12_495.md) — `0/2` on `?? throw` = factory threw
-- [qfc-bridge-router-495](project_qfc_breadcrumb_bridge_router_495.md) — wrong router's rate matches to 6 dp
-- [breadcrumb-messenger-hub-495](project_breadcrumb_messenger_hub_495.md) — finalizer makes branch GC-dependent
-- [qfc-upgrade-lifetime-495](project_qfc_upgrade_lifetime_495.md) — `<class name>` can name secondary type
-- [qfc-item-227-r2-denial](project_qfc_item_controller_227_r2_denial.md) — blanket exemption denied
-- [qfc227-headless-itemviewer](project_qfc227_headless_itemviewer_and_tlpcellsnapshot.md) — headless ItemViewer safe
-- [qfc-datamodel-coverage-436](project_qfc_datamodel_coverage_436.md) — type-scoped exclude hides 3 partials; remove last
-- [efcdatamodel-coverage-436](project_efcdatamodel_coverage_436.md) — EmailFiler Sort/Open non-virtual; PackageItems(bool) dead
-- [qfc-queueprocessing-436](project_qfc_queueprocessing_436.md) — zero COM deref; missing FakeTimeProvider fails silently
-- [qfc-framebuilding-436](project_qfc_framebuilding_436.md) — Deedle not WinForms; DfDeedle dialogs behind IVT wall
-- [qfc-explorer-controller-435](project_qfc_explorer_controller_435.md) — DynamicProxyGenAssembly2 IVT in QfcHighConfidencePreFilter.cs
-- [qfc-form-controller-coverage-435](project_qfc_form_controller_coverage_435.md) — UndoConsumer `|| exit` busy-spins; RECONSTRUCTED, re-verify
-- [qfc-form-controller-setup-disposal-435](project_qfc_form_controller_setup_disposal_435.md) — no new seams; Cleanup idempotent
-- [duplicate-iqfcformcontroller-435](project_quickfiler_duplicate_iqfcformcontroller_435.md) — QuickFiler.Interfaces.IQfcFormController is dead code
-- [qfc-home-controller-metrics-433](project_qfc_home_controller_metrics_433.md) — metrics consumer never runs; BlockingCollection OCE needs token
-- [qfc-home-controller-iteration-433](project_qfc_home_controller_iteration_433.md) — #424 deadline leaked into 2-arg dequeue; Iterate dead
-- [qfc-home-controller-coverage-433](project_qfc_home_controller_coverage_433.md) — LaunchAsync 0% structurally; check both halves before splitting
-- [efc-home-controller-deps-437](project_efc_home_controller_deps_437.md) — deps ~86-93%; Production* statics vs ClassLevel hazard
-- [efc-home-controller-coverage-437](project_efc_home_controller_coverage_437.md) — Timing.cs reads no clock; dual default lambdas order-dependent
-- [efc-item-controller-452](project_efc_item_controller_452.md) — IItemViewer covers ~70% of viewer; WpfUiDispatcher ctor internal
-- [efc-form-controller-452](project_efc_form_controller_452.md) — ViewerQueueCore does NOT pool; #439 = namespace mismatch
-- [qfc-item-controller-230-pump-seam](project_qfc_item_controller_230_pump_seam.md) — #230 root of 4 exemptions; 3/19 on DEAD members
-- [qfc-item-controller-f10-coverage-453](project_qfc_item_controller_f10_coverage_453.md) — test files at 497/498 of 500
-- [qfc-item-controller-f10-init-453](project_excludefromcodecoverage_lambda_leak.md) — 3/7 Initialization exemptions on DEAD members
-- [qfc-conversation-seam-ratified-453](project_qfc_conversation_seam_ratified_453.md) — DoLoadConversationResolverCoreAsync exemption #227-ratified
-- [qfc-collection-controller-454](project_qfc_collection_controller_454.md) — 12 unreachable members; `async public` defeats greps
-- [quickfiler-test-sta-and-ivt](project_quickfiler_test_sta_and_ivt.md) — QuickFiler grants internals to QuickFiler.Test; manual STA infra exists
-- [qfc-breadcrumb-dropdown-f13-455](project_qfc_breadcrumb_dropdown_f13_455.md) — async `throw;` makes catch brace unreachable
-- [qfc455-reentrant-dispose-seam](project_qfc455_reentrant_dispose_seam.md) — disposal-callback reentrancy opens the async window
-- [qfc-itemviewer-coverage-456](project_qfc_itemviewer_coverage_456.md) — class line-rate corrupt, branch-rate sound; STA attrs in MSTest 4.3.3
-- [qfc-breadcrumb-lifecycle-f12-495](project_qfc_breadcrumb_lifecycle_f12_495.md) — `0/2` on `factory() ?? throw` means factory threw
-- [qfc-breadcrumb-bridge-router-495](project_qfc_breadcrumb_bridge_router_495.md) — wrong router's branch-rate matches to 6 digits
-- [breadcrumb-messenger-hub-495](project_breadcrumb_messenger_hub_495.md) — Component finalizer makes a branch GC-dependent
-- [qfc-upgrade-lifetime-495](project_qfc_upgrade_lifetime_495.md) — `<class name>` can name a secondary type
-- [qfc-item-controller-227-r2-denial](project_qfc_item_controller_227_r2_denial.md) — maintainer denied blanket exemption; per-member precedent
-- [qfc227-headless-itemviewer](project_qfc227_headless_itemviewer_and_tlpcellsnapshot.md) — headless ItemViewer safe; target 24 -> 19
-- [issue-search-without-gh](reference_github_issue_search_without_gh.md) — WebFetch issues?q=...; mark [V-web]
-- [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult on pool thread INLINES
-- [prime-marker-944](project_prime_marker_register_before_start_944.md) — ContinueWith(None) never inlines; TCS marker before start
-- [uithread-restore-493](project_uithread_dispatcher_restore_scope_493.md) — never one semaphore for helper+fixture
-- [filerqueue-consumer-633](project_filerqueue_consumer_unsound_633.md) — orphaned-item race; vacuous tests
-- [gettableinviewasync-838](project_gettableinviewasync_null_contract_838.md) — `maxAttempts:1` = TWO attempts
-- [closure-exemption-457](project_cobertura_closure_exemption_457.md) — exempt members emit no `<method>`; `d__` trap
-- [root-attrs-raw-vs-post](project_cobertura_root_attrs_raw_vs_postprocessed.md) — never compare raw vs Koverage totals
-- [double-count-815](project_cobertura_double_count_moves_counts_not_rates_815.md) — doubles counters, pct <=0.46pp
-- [threshold-reconciliation-494](project_coverage_threshold_reconciliation_494.md) — 85/75 foreign leakage; gate evadable
-- [perfile-attribution](project_cobertura_perfile_attribution_contract.md) — recompute from `<lines>`
-- [line-double-count](project_cobertura_line_double_count.md) — lines-valid ~2x actual
-- [exemption-branchrate-gotchas](project_cobertura_exemption_and_branchrate_gotchas.md) — method exclude leaks lambdas
-- [qfc455-lambda-leak](project_qfc455_exclude_attribute_lambda_leak.md) — #441 inflation = per-method `<lines>`
-- [webview2-exemption-asymmetry](project_webview2_exemption_and_coverage_asymmetry.md) — class-level hides lambdas
-- [partial-type-exclusion-456](project_partial_type_coverage_exclusion_456.md) — de-exempting designer RAISES coverage
-- [designer-coverage](project_winforms_designer_coverage_mechanics.md) — one construction covers ~99% Designer
-- [itemviewer-partial-coupling](project_itemviewer_partial_exemption_coupling.md) — one attr hides 6 partials
-- [iqfcdatamodel-436](project_iqfcdatamodel_contract_436.md) — no class element for interfaces/enums
-- [interface-only-files-433](project_quickfiler_interface_only_files_433.md) — IQfcHomeController.cs exists twice
-- [percoverage-epic-136](project_quickfiler_percoverage_epic_136.md) — read per-file rate from Cobertura
-- [coverage-ledger-432](project_quickfiler_coverage_ledger_432.md) — 40 usages/21 files, not 33
-- [capstone-f16](project_quickfiler_capstone_f16_measurement.md) — `<sources>` discriminates raw vs post
-- [f9-441-designer](project_qfc_f9_measurement_441_and_designer_inheritance.md) — 6dp vs 16dp tell
-- [helper-classes-434](project_qfc_helper_classes_f4_434.md) — EmailMoveMonitor seam exists
-- [theme-cluster-434](project_qfc_theme_cluster_f4_434.md) — no colour getters
-- [viewerqueue-434](project_qfc_perfile_coverage_viewerqueue_434.md) — method-group sites forbid optional params
-- [keyboard-430](project_qfc_keyboard_coverage_430.md) — no IVT to QuickFiler.Test; headless ItemViewer OK
-- [keyboard-actions-430](project_qfc_keyboard_actions_430.md) — KaStringAsync has no async/timer
-- [datamodel-436](project_qfc_datamodel_coverage_436.md) — type exclude hides 3 partials
-- [efcdatamodel-436](project_efcdatamodel_coverage_436.md) — Sort/Open non-virtual
-- [queueprocessing-436](project_qfc_queueprocessing_436.md) — missing FakeTimeProvider fails silently
-- [framebuilding-436](project_qfc_framebuilding_436.md) — Deedle; dialogs behind IVT wall
-- [explorer-controller-435](project_qfc_explorer_controller_435.md) — DynamicProxy IVT in QfcHighConfidencePreFilter.cs
-- [form-controller-435](project_qfc_form_controller_coverage_435.md) — UndoConsumer busy-spins; re-verify
-- [form-controller-disposal-435](project_qfc_form_controller_setup_disposal_435.md) — Cleanup idempotent
-- [duplicate-iqfcformcontroller-435](project_quickfiler_duplicate_iqfcformcontroller_435.md) — Interfaces copy dead
-- [home-metrics-433](project_qfc_home_controller_metrics_433.md) — metrics consumer never runs
-- [home-iteration-433](project_qfc_home_controller_iteration_433.md) — Iterate dead; deadline leak
-- [home-coverage-433](project_qfc_home_controller_coverage_433.md) — LaunchAsync 0% structurally
-- [efc-home-deps-437](project_efc_home_controller_deps_437.md) — Production* statics vs ClassLevel
-- [efc-item-controller-452](project_efc_item_controller_452.md) — IItemViewer covers ~70%
-- [item-controller-230-seam](project_qfc_item_controller_230_pump_seam.md) — #230 root of 4 exemptions
-- [item-controller-f10-453](project_qfc_item_controller_f10_coverage_453.md) — test files at 497/498
-- [f10-init-453](project_excludefromcodecoverage_lambda_leak.md) — 3/7 exemptions on DEAD members
-- [conversation-seam-453](project_qfc_conversation_seam_ratified_453.md) — #227-ratified exemption
-- [collection-controller-454](project_qfc_collection_controller_454.md) — `async public` defeats greps
-- [test-sta-and-ivt](project_quickfiler_test_sta_and_ivt.md) — manual STA infra exists
-- [breadcrumb-dropdown-455](project_qfc_breadcrumb_dropdown_f13_455.md) — async `throw;` brace unreachable
-- [reentrant-dispose-455](project_qfc455_reentrant_dispose_seam.md) — reentrancy opens async window
-- [itemviewer-456](project_qfc_itemviewer_coverage_456.md) — line-rate corrupt, branch-rate sound
-- [breadcrumb-lifecycle-495](project_qfc_breadcrumb_lifecycle_f12_495.md) — `0/2` on `?? throw` = factory threw
-- [bridge-router-495](project_qfc_breadcrumb_bridge_router_495.md) — wrong router matches 6 digits
-- [messenger-hub-495](project_breadcrumb_messenger_hub_495.md) — finalizer makes branch GC-dependent
-- [upgrade-lifetime-495](project_qfc_upgrade_lifetime_495.md) — `<class name>` can name secondary type
-- [item-controller-227-denial](project_qfc_item_controller_227_r2_denial.md) — per-member precedent
-- [headless-itemviewer-227](project_qfc227_headless_itemviewer_and_tlpcellsnapshot.md) — target 24 -> 19
-
-## QuickFiler / EFC / SortEmail defects and behaviour
-- [sortemail-split-prompt-seam-956](project_sortemail_split_and_prompt_seam_956.md) — per-call prompt session; AsyncLocal breaks stickiness
-- [sortemail-966-consolidation-959](project_sortemail_966_consolidation_959.md) — live path builds helpers with FOLDER NAME; A 235 re-roots one path; ToDoModel copy uncompiled
-- [sortemail-latent-defects-959](project_sortemail_latent_defects_959.md) — callers discard the bool: only rethrow surfaces; L4 has a 3rd (null-array) defect
-- [qfc-high-confidence-pipelines](project_qfc_high_confidence_dual_pipeline.md) — THREE pipelines; #233 gate LIVE
-- [qfc424-startup-stall](project_qfc424_high_confidence_startup_stall.md) — serial scoring; async-void worker
-- [qfc678-predictor-carry](project_qfc678_predictor_carry.md) — named producer DORMANT
-- [qfc791-deadline-teardown](project_qfc791_deadline_and_cancel_teardown.md) — superseded by #424/#608 ACs
-- [qfc810-teardown-dropdown](project_qfc810_teardown_dropdown_residuals.md) — method-group blocks optional param
-- [qfc823-review-residuals](project_qfc823_review_residuals.md) — R2 follow-up is #813
-- [teardown-guard-821](project_teardown_guard_enumeration_821.md) — 4th sharer is 4th Cancel() site
-- [qfc-lifecycle-disposal-731](project_qfc_lifecycle_disposal_731.md) — sharing EmailMoveMonitor drops actions
-- [qfc254-darkmode-labels](project_qfc254_darkmode_stale_labels.md) — labels themed only in MailRead branch
-- [qfc254-residual](project_qfc254_residual_after_comexception_fix.md) — #269 cause = fore/back swap
-- [qfc254-ambient-inheritance](project_qfc254_ambient_inheritance_mechanism.md) — SUPERSEDED; ambient notes accurate
-- [qfc438-focus-steal](project_qfc438_search_focus_steal.md) — TWO focus-steal mechanisms
-- [qfc677-webview2-focus](project_qfc677_webview2_focus_hold_outlook_keyboard.md) — WV2 focus hold + anchor steal
-- [qfc680-menu-mode](project_qfc680_menu_mode_keyboard_capture.md) — ModalMenuFilter; AutoClose=false pre-Show
-- [qfc663-alt-chord](project_qfc663_alt_chord_no_altf.md) — only Alt+M swallowed
-- [qfc-keyboard-defects-444](project_qfc_keyboard_action_defects_444.md) — trigger Right/Down/Right
-- [breadcrumb-nav-439-440](project_breadcrumb_navigation_defects_439_440_498_499.md) — #439 fix regresses join
-- [issue-440-via-498](project_issue_440_already_landed_via_498.md) — Efc/Qfc do NOT share BreadcrumbRow
-- [qfc-item-defects-484](project_qfc_item_controller_defects_484.md) — all 5 Suspected Fix sections wrong
-- [webview2-initializer-476](project_webview2_host_initializer_defects_476.md) — EfcViewerQueue not a pool
-- [qfc-efc-metrics-442](project_qfc_efc_metrics_442.md) — stopwatch race unfixable in owned files
-- [qfc-collection-defects-468](project_qfc_collection_defects_468.md) — MovedMails param redundant
-- [qfc-collection-controller-468](project_qfc_collection_controller_defects_468.md) — "unrelated interfaces" FALSE
-- [issue-469-residual-629](project_issue_469_already_fixed_residual_is_629.md) — `Initialized<T>` never memoizes
-- [reflective-caller-635](project_reflective_caller_closure_635.md) — `GetField(` is the reaching mechanism
-- [selectrow-families-637](project_selectrow_two_families_637.md) — TWO SelectRow families
-- [issue-656-no-bypass](project_issue_656_bypass_path_does_not_exist.md) — premise FALSE
-- [efc614-stem-leak](project_efc614_store_root_stem_leak.md) — FolderConverterTests.cs:329 codifies a bug
-- [efc736-archiveroot-sink](project_efc736_archiveroot_boundary_sink.md) — 6 sink sites not 4
-- [banner-prefix-arity-662](project_banner_prefix_arity_662.md) — `/Tests:` vs `/TestCaseFilter:` exclusive
-- [qfc-folder-tree-325](project_qfc_folder_tree_percentage_325.md) — 1 live viewer, 9 dead CboFolders
-- [qfc-breadcrumb-webview2-351](project_qfc_breadcrumb_webview2_351.md) — bridge greenfield
-- [folder-hierarchy-provider-350](project_folder_hierarchy_provider_350.md) — reuse snapshot infra
-- [efcviewer-breadcrumb-349](project_efcviewer_breadcrumb_webview2_349.md) — unscaled ColumnHeader widths
-- [folder-settings-797](project_folder_settings_persistence_797.md) — ThisAddIn_Shutdown never raised
-- [ilglobals-static-824](project_ilglobals_static_publication_824.md) — BeSameAs only order-independent RED gate
-- [etl-deadline-825](project_etl_deadline_followups_825.md) — read shipped package .xml to verify API
-## QuickFiler / EFC defects and behaviour
-- [qfc-high-confidence-dual-pipeline](project_qfc_high_confidence_dual_pipeline.md) — THREE pipelines; #233 gate LIVE, #169/#171 dormant
-- [qfc424-startup-stall](project_qfc424_high_confidence_startup_stall.md) — gate scores serially; async-void BackgroundWorker; STA blocks parallel COM
-- [qfc678-predictor-carry](project_qfc678_predictor_carry.md) — named producer DORMANT; PreScored never read
-- [qfc791-deadline-cancel-teardown](project_qfc791_deadline_and_cancel_teardown.md) — empty-at-deadline superseded by #424/#608 ACs
-- [qfc810-teardown-dropdown-residuals](project_qfc810_teardown_dropdown_residuals.md) — method-group blocks optional param (CS0123); files at 496/500
-- [qfc823-review-residuals](project_qfc823_review_residuals.md) — R3 null-tolerance doc FALSE; R2 follow-up is #813
-- [teardown-guard-enumeration-821](project_teardown_guard_enumeration_821.md) — 4th sharer is the 4th Cancel() SITE; enabler is SetCancellationTokenSource
-- [qfc-lifecycle-disposal-731](project_qfc_lifecycle_disposal_731.md) — sharing EmailMoveMonitor DROPS actions; `volatile` = CS0420
-- [qfc254-darkmode-stale-labels](project_qfc254_darkmode_stale_labels.md) — labels themed only in MailRead()-guarded branch
-- [qfc254-residual-after-comexception-fix](project_qfc254_residual_after_comexception_fix.md) — historical; #269 real cause = Light-theme fore/back swap
-- [qfc254-ambient-inheritance](project_qfc254_ambient_inheritance_mechanism.md) — SUPERSEDED for #269; WinForms ambient inheritance notes still accurate
-- [qfc438-search-focus-steal](project_qfc438_search_focus_steal.md) — TWO focus-steal mechanisms; CancelSelector emits no SelectionChanged
-- [qfc677-webview2-focus-hold](project_qfc677_webview2_focus_hold_outlook_keyboard.md) — WebView2 focus hold + _focusAnchor steal; fix = focus predicate
-- [qfc680-menu-mode-keyboard-capture](project_qfc680_menu_mode_keyboard_capture.md) — ModalMenuFilter; AutoClose=false pre-Show only opt-out
-- [qfc663-alt-chord-no-altf](project_qfc663_alt_chord_no_altf.md) — only Alt+M swallowed; Alt+F is EFC-only
-- [qfc-keyboard-action-defects-444](project_qfc_keyboard_action_defects_444.md) — #468 removes duplicate registration; trigger Right/Down/Right
-- [breadcrumb-navigation-defects-439-440](project_breadcrumb_navigation_defects_439_440_498_499.md) — fixing #439 regresses percentage join
-- [issue-440-already-landed-via-498](project_issue_440_already_landed_via_498.md) — Efc/Qfc do NOT share BreadcrumbRow
-- [qfc-item-controller-defects-484](project_qfc_item_controller_defects_484.md) — all 5 "Suspected Fix" sections wrong; verify callers first
-- [webview2-host-initializer-defects-476](project_webview2_host_initializer_defects_476.md) — EfcViewerQueue not a pool; real WebView2 built in tests
-- [qfc-efc-metrics-442](project_qfc_efc_metrics_442.md) — MoveAndIterate stopwatch race unfixable in owned files
-- [qfc-collection-defects-468](project_qfc_collection_defects_468.md) — MovedMails param redundant; no log4net in QuickFiler.Test
-- [qfc-collection-controller-defects-468](project_qfc_collection_controller_defects_468.md) — #474 "unrelated interfaces" FALSE
-- [issue-469-already-fixed-residual-629](project_issue_469_already_fixed_residual_is_629.md) — `Initialized<T>` never memoizes
-- [reflective-caller-closure-635](project_reflective_caller_closure_635.md) — removal was 13 members; `GetField(` is the reaching mechanism
-- [selectrow-two-families-637](project_selectrow_two_families_637.md) — TWO SelectRow families; ButtonOK_Click does NOT rethrow
-- [issue-656-bypass-path-does-not-exist](project_issue_656_bypass_path_does_not_exist.md) — premise FALSE; owner files at cap
-- [efc614-store-root-stem-leak](project_efc614_store_root_stem_leak.md) — FolderConverterTests.cs:329 codifies a bug
-- [efc736-archiveroot-boundary-sink](project_efc736_archiveroot_boundary_sink.md) — finding 6 cause FALSE; 6 sink sites not 4
-- [banner-prefix-arity-662](project_banner_prefix_arity_662.md) — `/Tests:` and `/TestCaseFilter:` mutually exclusive
-- [qfc-folder-tree-percentage-325](project_qfc_folder_tree_percentage_325.md) — 1 live viewer despite 9 dead CboFolders
-- [qfc-breadcrumb-webview2-351](project_qfc_breadcrumb_webview2_351.md) — 9101 provider absent; bridge greenfield
-- [folder-hierarchy-provider-350](project_folder_hierarchy_provider_350.md) — reuse snapshot infra; no new COM seam
-- [efcviewer-breadcrumb-webview2-349](project_efcviewer_breadcrumb_webview2_349.md) — EfcViewer3 dead; unscaled ColumnHeader widths
-- [folder-settings-persistence-797](project_folder_settings_persistence_797.md) — ThisAddIn_Shutdown never raised; a test asserts the AC8 bug
-- [ilglobals-static-publication-824](project_ilglobals_static_publication_824.md) — BeSameAs only order-independent RED gate; CA2211 never fires
-- [etl-deadline-followups-825](project_etl_deadline_followups_825.md) — read shipped package .xml to verify API
-
 ## Stores / watchdog / add-in lifecycle
 - [store-runtime-reenable-263](project_store_runtime_reenable_263.md) — no per-store hookup seam
 - [store-lockup-f4](project_store_lockup_resilience_f4_research.md) — AsyncLocal rejected; MyBox no modeless
@@ -287,84 +68,16 @@
 - [storewrapper-dialog-287](project_storewrapper_dialog_287_state_inversion.md) — issue inverts the two states
 
 ## Ribbon, CI, toolchain, repo structure
-- [ribbon-readiness-503](project_ribbon_engine_readiness_503.md) — Ribbon coverage-excluded; 5 orphan callbacks
+- [ribbon-readiness-503](project_ribbon_engine_readiness_503.md) — Ribbon coverage-excluded; 5 orphan onAction callbacks
 - [ribbon-toggle-guards-505](project_ribbon_toggle_state_guards_505.md) — toggle vs command guard asymmetry
-- [ribbon-toggle-defects-735](project_ribbon_engine_toggle_defects_735.md) — 84 callbacks (5 dead)
-- [ci-parallel-split-553](project_ci_parallel_split_553.md) — check names "caller / callee"
-- [toolchain-gate-fidelity-512](project_toolchain_gate_fidelity_512.md) — ~1.2s vs ~17s = vacuity
-- [console-out-rs0030-826](project_console_out_and_rs0030_promotion_826.md) — no GenerateDocumentationFile: IDE0005 silent
-- [fsharp-hintpath-skew-895](project_fsharp_core_hintpath_skew_895.md) — 15 output dirs; packages.config gap
-- [binding-redirect-drift-973](project_binding_redirect_drift_and_missing_asyncenumerable_973.md) — NuGet rewrites only installer's config; AsyncEnumerable install ruled in scope (aliased)
-- [graph-usings-removable-973](project_graph_usings_removable_and_models_name_collisions_973.md) — all 6 Graph usings removable; Models exports List/Application/OutlookItem; reflog = clock fallback
-- [ixnet-v7-lib-ref-clash](project_ixnet_v7_lib_ref_clash_packages_config.md) — lib/net48 keeps public AsyncEnumerable; global BCL ref = CS0121; use `<Aliases>`; Directory.Build.props exists
-- [dependabot-net481-340](project_dependabot_net481_340.md) — semver-major ignore, no ceilings
-- [svgcontrol-test-418](project_svgcontrol_test_unwired_418.md) — STALE; in .sln since 2026-08-14
-- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — PQ setting no var substitution
-- [push-down-claude-dir-149](project_push_down_claude_dir.md) — pushDownClaudeDir research
-- [winforms-testability-298](project_winforms_testability_epic_298.md) — #298 depends on #297
-- [tagcontroller-293](project_tagcontroller_refactor_293.md) — PrefixItem NotImplemented
-- [swordfish-removal-306](project_swordfish_removal_epic_306.md) — legacy JSON via ScoDictionaryNew
-- [legacy-scodictionary-315](project_legacy_scodictionary_removal_315.md) — delete SCODictionary_Tests
-- [ribbon-engine-readiness-503](project_ribbon_engine_readiness_503.md) — Ribbon layer coverage-excluded; 5 orphan onAction callbacks
-- [ribbon-toggle-state-guards-505](project_ribbon_toggle_state_guards_505.md) — toggle vs command guard asymmetry
-- [ribbon-engine-toggle-defects-735](project_ribbon_engine_toggle_defects_735.md) — 84 callback names (5 dead); ManagerAsyncLazy constructible
-- [fsharp-core-hintpath-skew-895](project_fsharp_core_hintpath_skew_895.md) — 15 output dirs; Sync-PackageReferences ranks ns2.1>2.0; ToDoModel.Test packages.config gap
-- [fsharp-core-hintpath-skew-895](project_fsharp_core_hintpath_skew_895.md) — 15 output dirs; Sync-PackageReferences ranks ns2.1>2.0; ToDoModel.Test gap
+- [ribbon-toggle-defects-735](project_ribbon_engine_toggle_defects_735.md) — 84 callbacks (5 dead); ManagerAsyncLazy constructible
 - [ci-parallel-split-553](project_ci_parallel_split_553.md) — 4 independent jobs; check names "caller / callee"
-- [toolchain-gate-fidelity-512](project_toolchain_gate_fidelity_512.md) — AGENTS.md externally owned; ~1.2s vs ~17s = vacuity
-- [console-out-and-rs0030-826](project_console_out_and_rs0030_promotion_826.md) — Directory.Build.props exists; CS0169/CS0414 is the hazard
-- [dependabot-net481-340](project_dependabot_net481_340.md) — semver-major ignore, no fabricated ceilings
-- [svgcontrol-test-unwired-418](project_svgcontrol_test_unwired_418.md) — STALE (in .sln since 2026-08-14); redirect topology historical
-- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — PQ setting no var substitution; rg-vs-git deltas; basename gotcha
-- [push-down-claude-dir-149](project_push_down_claude_dir.md) — #149 pushDownClaudeDir research (2026-04-16)
-- [winforms-testability-epic-298](project_winforms_testability_epic_298.md) — #298 depends on #297; inverts #197 exemptions
-- [tagcontroller-refactor-293](project_tagcontroller_refactor_293.md) — ITagViewer/IForm gaps; PrefixItem NotImplemented
-- [swordfish-removal-epic-306](project_swordfish_removal_epic_306.md) — legacy flat JSON round-trips via ScoDictionaryNew
-- [legacy-scodictionary-removal-315](project_legacy_scodictionary_removal_315.md) — delete SCODictionary_Tests, retarget 3 files
+- [toolchain-gate-fidelity-512](project_toolchain_gate_fidelity_512.md) — ~1.2s vs ~17s = vacuity
+- [console-out-rs0030-826](project_console_out_and_rs0030_promotion_826.md) — CS0169/CS0414 hazard; IDE0005 silent
+- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — PQ setting no var substitution; rg-vs-git deltas
+- [evidence-identity-sweep-927](project_evidence_identity_hygiene_sweep_927.md) — classify raw evidence by XML root
 - [push-down-claude-dir-149](project_push_down_claude_dir.md) — #149 pushDownClaudeDir research (2026-04-16)
-- [high-confidence-pipelines](project_qfc_high_confidence_dual_pipeline.md) — THREE pipelines; #233 gate LIVE
-- [startup-stall-424](project_qfc424_high_confidence_startup_stall.md) — serial scoring; async-void worker
-- [predictor-carry-678](project_qfc678_predictor_carry.md) — PreScored never read
-- [deadline-teardown-791](project_qfc791_deadline_and_cancel_teardown.md) — superseded by #424/#608 ACs
-- [teardown-dropdown-810](project_qfc810_teardown_dropdown_residuals.md) — CS0123; files at 496/500
-- [review-residuals-823](project_qfc823_review_residuals.md) — follow-up is #813
-- [lifecycle-disposal-731](project_qfc_lifecycle_disposal_731.md) — sharing monitor DROPS actions
-- [darkmode-labels-254](project_qfc254_darkmode_stale_labels.md) — themed only in MailRead() branch
-- [qfc254-residual](project_qfc254_residual_after_comexception_fix.md) — #269 = Light-theme swap
-- [qfc254-ambient](project_qfc254_ambient_inheritance_mechanism.md) — SUPERSEDED; ambient notes accurate
-- [search-focus-438](project_qfc438_search_focus_steal.md) — TWO focus-steal mechanisms
-- [webview2-focus-677](project_qfc677_webview2_focus_hold_outlook_keyboard.md) — fix = focus predicate
-- [menu-mode-680](project_qfc680_menu_mode_keyboard_capture.md) — AutoClose=false pre-Show only
-- [alt-chord-663](project_qfc663_alt_chord_no_altf.md) — only Alt+M swallowed
-- [keyboard-defects-444](project_qfc_keyboard_action_defects_444.md) — trigger Right/Down/Right
-- [issue-440-via-498](project_issue_440_already_landed_via_498.md) — Efc/Qfc don't share BreadcrumbRow
-- [item-controller-484](project_qfc_item_controller_defects_484.md) — all 5 Suspected Fix wrong
-- [webview2-init-476](project_webview2_host_initializer_defects_476.md) — EfcViewerQueue not a pool
-- [metrics-442](project_qfc_efc_metrics_442.md) — stopwatch race unfixable in owned files
-- [collection-defects-468](project_qfc_collection_defects_468.md) — no log4net in QuickFiler.Test
-- [collection-controller-468](project_qfc_collection_controller_defects_468.md) — #474 premise FALSE
-- [issue-469-fixed-629](project_issue_469_already_fixed_residual_is_629.md) — `Initialized<T>` never memoizes
-- [reflective-closure-635](project_reflective_caller_closure_635.md) — `GetField(` reaches 13 members
-- [selectrow-637](project_selectrow_two_families_637.md) — TWO SelectRow families
-- [store-root-stem-614](project_efc614_store_root_stem_leak.md) — test codifies a bug
-- [archiveroot-sink-736](project_efc736_archiveroot_boundary_sink.md) — 6 sink sites not 4
-- [banner-prefix-662](project_banner_prefix_arity_662.md) — `/Tests:` vs `/TestCaseFilter:` exclusive
-- [folder-tree-pct-325](project_qfc_folder_tree_percentage_325.md) — 1 live viewer
-- [breadcrumb-wv2-351](project_qfc_breadcrumb_webview2_351.md) — bridge greenfield
-- [folder-hierarchy-350](project_folder_hierarchy_provider_350.md) — reuse snapshot infra
-- [efcviewer-breadcrumb-349](project_efcviewer_breadcrumb_webview2_349.md) — EfcViewer3 dead
-- [ilglobals-824](project_ilglobals_static_publication_824.md) — BeSameAs only RED gate
-- [etl-deadline-825](project_etl_deadline_followups_825.md) — read package .xml to verify API
-- [store-reenable-263](project_store_runtime_reenable_263.md) — no per-store hookup seam
-- [store-lockup-f4](project_store_lockup_resilience_f4_research.md) — AsyncLocal rejected
-- [storewrapper-dialog-287](project_storewrapper_dialog_287_state_inversion.md) — state inversion
-- [ribbon-readiness-503](project_ribbon_engine_readiness_503.md) — 5 orphan onAction callbacks
-- [ribbon-toggle-guards-505](project_ribbon_toggle_state_guards_505.md) — toggle vs command asymmetry
-- [toolchain-fidelity-512](project_toolchain_gate_fidelity_512.md) — ~1.2s vs ~17s = vacuity
-- [console-out-rs0030-826](project_console_out_and_rs0030_promotion_826.md) — CS0169/CS0414 hazard
-- [fsharp-hintpath-895](project_fsharp_core_hintpath_skew_895.md) — 15 output dirs; ns2.1>2.0 ranking
-- [dependabot-340](project_dependabot_net481_340.md) — semver-major ignore
-- [winforms-epic-298](project_winforms_testability_epic_298.md) — depends on #297
-- [swordfish-306](project_swordfish_removal_epic_306.md) — round-trips via ScoDictionaryNew
-- [scodictionary-315](project_legacy_scodictionary_removal_315.md) — delete tests, retarget 3 files
-- [host-identifier-sweep-602](project_host_identifier_sweep_602.md) — rg-vs-git deltas
+- [winforms-testability-298](project_winforms_testability_epic_298.md) — #298 depends on #297; inverts #197 exemptions
+- [tagcontroller-293](project_tagcontroller_refactor_293.md) — ITagViewer/IForm gaps; PrefixItem NotImplemented
+- [swordfish-removal-306](project_swordfish_removal_epic_306.md) — legacy JSON round-trips via ScoDictionaryNew
+- [legacy-scodictionary-315](project_legacy_scodictionary_removal_315.md) — delete SCODictionary_Tests, retarget 3 files
diff --git a/.claude/agent-memory/task-researcher/index_epic136_percoverage_children.md b/.claude/agent-memory/task-researcher/index_epic136_percoverage_children.md
new file mode 100644
index 000000000..89dc7263b
--- /dev/null
+++ b/.claude/agent-memory/task-researcher/index_epic136_percoverage_children.md
@@ -0,0 +1,44 @@
+---
+name: index-epic136-percoverage-children
+description: Sub-index of task-researcher memories for QuickFiler/EFC per-file coverage epic #136 child items (430-495, 227); open when researching coverage of a QuickFiler or EFC class
+metadata:
+  type: reference
+---
+
+Sub-index split out of MEMORY.md (2026-10-09) to keep the root index under its read limit. One line per memory file.
+
+- [qfc-helper-classes-434](project_qfc_helper_classes_f4_434.md) — EmailMoveMonitor seam; explicit Compile Includes
+- [qfc-theme-cluster-434](project_qfc_theme_cluster_f4_434.md) — theme+layout tests-only; no colour getters
+- [qfc-viewerqueue-434](project_qfc_perfile_coverage_viewerqueue_434.md) — method-group sites forbid optional params
+- [qfc-keyboard-coverage-430](project_qfc_keyboard_coverage_430.md) — no IVT UtilitiesCS->QuickFiler.Test; headless ItemViewer OK
+- [qfc-keyboard-actions-430](project_qfc_keyboard_actions_430.md) — KaStringAsync has no async/timer
+- [qfc-datamodel-436](project_qfc_datamodel_coverage_436.md) — type-scoped exclude hides 3 partials; remove last
+- [efcdatamodel-436](project_efcdatamodel_coverage_436.md) — EmailFiler Sort/Open non-virtual; PackageItems(bool) dead
+- [qfc-queueprocessing-436](project_qfc_queueprocessing_436.md) — zero COM deref; missing FakeTimeProvider fails silently
+- [qfc-framebuilding-436](project_qfc_framebuilding_436.md) — Deedle not WinForms; DfDeedle dialogs behind IVT wall
+- [qfc-explorer-controller-435](project_qfc_explorer_controller_435.md) — DynamicProxyGenAssembly2 IVT in QfcHighConfidencePreFilter.cs
+- [qfc-form-controller-435](project_qfc_form_controller_coverage_435.md) — UndoConsumer busy-spins; RECONSTRUCTED, re-verify
+- [qfc-form-setup-disposal-435](project_qfc_form_controller_setup_disposal_435.md) — no new seams; Cleanup idempotent
+- [duplicate-iqfcformcontroller-435](project_quickfiler_duplicate_iqfcformcontroller_435.md) — QuickFiler.Interfaces copy is dead code
+- [qfc-home-metrics-433](project_qfc_home_controller_metrics_433.md) — metrics consumer never runs; OCE needs token
+- [qfc-home-iteration-433](project_qfc_home_controller_iteration_433.md) — #424 deadline leaked into 2-arg dequeue; Iterate dead
+- [qfc-home-coverage-433](project_qfc_home_controller_coverage_433.md) — LaunchAsync 0% structurally
+- [efc-home-deps-437](project_efc_home_controller_deps_437.md) — Production* statics vs ClassLevel hazard
+- [efc-home-coverage-437](project_efc_home_controller_coverage_437.md) — Timing.cs reads no clock; default lambdas order-dependent
+- [efc-item-controller-452](project_efc_item_controller_452.md) — IItemViewer covers ~70% of viewer; WpfUiDispatcher ctor internal
+- [efc-form-controller-452](project_efc_form_controller_452.md) — ViewerQueueCore does NOT pool; #439 = namespace mismatch
+- [qfc-item-230-pump-seam](project_qfc_item_controller_230_pump_seam.md) — #230 root of 4 exemptions; 3/19 on DEAD members
+- [qfc-item-f10-453](project_qfc_item_controller_f10_coverage_453.md) — test files at 497/498 of 500
+- [qfc-item-f10-init-453](project_excludefromcodecoverage_lambda_leak.md) — 3/7 Initialization exemptions on DEAD members
+- [qfc-conversation-seam-453](project_qfc_conversation_seam_ratified_453.md) — exemption #227-ratified
+- [qfc-collection-controller-454](project_qfc_collection_controller_454.md) — 12 unreachable members; `async public` defeats greps
+- [quickfiler-test-sta-ivt](project_quickfiler_test_sta_and_ivt.md) — QuickFiler grants internals to QuickFiler.Test; manual STA infra
+- [qfc-dropdown-f13-455](project_qfc_breadcrumb_dropdown_f13_455.md) — async `throw;` makes catch brace unreachable
+- [qfc455-reentrant-dispose](project_qfc455_reentrant_dispose_seam.md) — disposal-callback reentrancy opens async window
+- [qfc-itemviewer-456](project_qfc_itemviewer_coverage_456.md) — line-rate corrupt, branch-rate sound; STA attrs in MSTest 4.3.3
+- [qfc-breadcrumb-lifecycle-495](project_qfc_breadcrumb_lifecycle_f12_495.md) — `0/2` on `factory() ?? throw` = factory threw
+- [qfc-bridge-router-495](project_qfc_breadcrumb_bridge_router_495.md) — wrong router's branch-rate matches to 6 digits
+- [breadcrumb-messenger-hub-495](project_breadcrumb_messenger_hub_495.md) — Component finalizer makes a branch GC-dependent
+- [qfc-upgrade-lifetime-495](project_qfc_upgrade_lifetime_495.md) — `<class name>` can name a secondary type
+- [qfc-item-227-r2-denial](project_qfc_item_controller_227_r2_denial.md) — maintainer denied blanket exemption; per-member precedent
+- [qfc227-headless-itemviewer](project_qfc227_headless_itemviewer_and_tlpcellsnapshot.md) — headless ItemViewer safe; target 24 -> 19
diff --git a/.claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md b/.claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md
new file mode 100644
index 000000000..5a2cae72e
--- /dev/null
+++ b/.claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md
@@ -0,0 +1,49 @@
+---
+name: index-quickfiler-efc-defects
+description: Sub-index of task-researcher memories on QuickFiler/EFC/SortEmail defect and behaviour research (focus, keyboard, breadcrumb, teardown, high-confidence pipelines); open when researching a QuickFiler or EFC bug
+metadata:
+  type: reference
+---
+
+Sub-index split out of MEMORY.md (2026-10-09) to keep the root index under its read limit. One line per memory file.
+
+- [sortemail-split-prompt-seam-956](project_sortemail_split_and_prompt_seam_956.md) — per-call prompt session; AsyncLocal breaks stickiness
+- [sortemail-966-consolidation-959](project_sortemail_966_consolidation_959.md) — live path builds helpers with FOLDER NAME; ToDoModel copy uncompiled
+- [sortemail-latent-defects-959](project_sortemail_latent_defects_959.md) — callers discard the bool; L4 has a null-array defect
+- [qfc-high-confidence-pipelines](project_qfc_high_confidence_dual_pipeline.md) — THREE pipelines; #233 gate LIVE, #169/#171 dormant
+- [qfc424-startup-stall](project_qfc424_high_confidence_startup_stall.md) — serial scoring; async-void worker; STA blocks parallel COM
+- [qfc678-predictor-carry](project_qfc678_predictor_carry.md) — named producer DORMANT; PreScored never read
+- [qfc791-deadline-teardown](project_qfc791_deadline_and_cancel_teardown.md) — superseded by #424/#608 ACs
+- [qfc810-teardown-dropdown](project_qfc810_teardown_dropdown_residuals.md) — method-group blocks optional param (CS0123); files at 496/500
+- [qfc823-review-residuals](project_qfc823_review_residuals.md) — R3 null-tolerance doc FALSE; R2 follow-up is #813
+- [teardown-guard-821](project_teardown_guard_enumeration_821.md) — 4th sharer is the 4th Cancel() site
+- [qfc-lifecycle-disposal-731](project_qfc_lifecycle_disposal_731.md) — sharing EmailMoveMonitor DROPS actions; `volatile` = CS0420
+- [qfc254-darkmode-labels](project_qfc254_darkmode_stale_labels.md) — labels themed only in MailRead()-guarded branch
+- [qfc254-residual](project_qfc254_residual_after_comexception_fix.md) — historical; #269 cause = Light-theme fore/back swap
+- [qfc254-ambient-inheritance](project_qfc254_ambient_inheritance_mechanism.md) — SUPERSEDED for #269; ambient notes accurate
+- [qfc438-focus-steal](project_qfc438_search_focus_steal.md) — TWO focus-steal mechanisms
+- [qfc677-webview2-focus](project_qfc677_webview2_focus_hold_outlook_keyboard.md) — WV2 focus hold + anchor steal; fix = focus predicate
+- [qfc680-menu-mode](project_qfc680_menu_mode_keyboard_capture.md) — ModalMenuFilter; AutoClose=false pre-Show only opt-out
+- [qfc663-alt-chord](project_qfc663_alt_chord_no_altf.md) — only Alt+M swallowed; Alt+F is EFC-only
+- [qfc-keyboard-defects-444](project_qfc_keyboard_action_defects_444.md) — trigger Right/Down/Right
+- [breadcrumb-nav-439-440](project_breadcrumb_navigation_defects_439_440_498_499.md) — fixing #439 regresses percentage join
+- [issue-440-via-498](project_issue_440_already_landed_via_498.md) — Efc/Qfc do NOT share BreadcrumbRow
+- [qfc-item-defects-484](project_qfc_item_controller_defects_484.md) — all 5 Suspected Fix sections wrong
+- [webview2-initializer-476](project_webview2_host_initializer_defects_476.md) — EfcViewerQueue not a pool
+- [qfc-efc-metrics-442](project_qfc_efc_metrics_442.md) — stopwatch race unfixable in owned files
+- [qfc-collection-defects-468](project_qfc_collection_defects_468.md) — MovedMails param redundant; no log4net in QuickFiler.Test
+- [qfc-collection-controller-468](project_qfc_collection_controller_defects_468.md) — #474 "unrelated interfaces" FALSE
+- [issue-469-residual-629](project_issue_469_already_fixed_residual_is_629.md) — `Initialized<T>` never memoizes
+- [reflective-caller-635](project_reflective_caller_closure_635.md) — `GetField(` is the reaching mechanism (13 members)
+- [selectrow-families-637](project_selectrow_two_families_637.md) — TWO SelectRow families
+- [issue-656-no-bypass](project_issue_656_bypass_path_does_not_exist.md) — premise FALSE; owner files at cap
+- [efc614-stem-leak](project_efc614_store_root_stem_leak.md) — FolderConverterTests.cs:329 codifies a bug
+- [efc736-archiveroot-sink](project_efc736_archiveroot_boundary_sink.md) — 6 sink sites not 4
+- [banner-prefix-arity-662](project_banner_prefix_arity_662.md) — `/Tests:` vs `/TestCaseFilter:` mutually exclusive
+- [qfc-folder-tree-325](project_qfc_folder_tree_percentage_325.md) — 1 live viewer, 9 dead CboFolders
+- [qfc-breadcrumb-webview2-351](project_qfc_breadcrumb_webview2_351.md) — bridge greenfield
+- [folder-hierarchy-provider-350](project_folder_hierarchy_provider_350.md) — reuse snapshot infra; no new COM seam
+- [efcviewer-breadcrumb-349](project_efcviewer_breadcrumb_webview2_349.md) — EfcViewer3 dead; unscaled ColumnHeader widths
+- [folder-settings-797](project_folder_settings_persistence_797.md) — ThisAddIn_Shutdown never raised
+- [ilglobals-static-824](project_ilglobals_static_publication_824.md) — BeSameAs only order-independent RED gate
+- [etl-deadline-825](project_etl_deadline_followups_825.md) — read shipped package .xml to verify API
diff --git a/.claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md b/.claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
new file mode 100644
index 000000000..8ea18e6e8
--- /dev/null
+++ b/.claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
@@ -0,0 +1,12 @@
+---
+name: dependabot-repair-workflow-run-script-source-985
+description: dependabot-repair runs default-branch YAML but the Dependabot branch's script; YAML edits (incl. workflows/README.md) can't be green-run pre-merge; redirect invariant is a union
+metadata:
+  type: project
+---
+
+`.github/workflows/dependabot-repair.yml` (workflow_run on CI) executes the default-branch YAML but checks out `head_branch` and runs THAT branch's `scripts/dependencies/Repair-PackageManifestConsistency.ps1`. A script fix reaches an existing Dependabot PR only after `@dependabot recreate` (`rebase` is refused once the repair bot has pushed a commit).
+
+**Why:** Any diff under `.github/workflows/**` (README.md included) trips `modified-workflow-needs-green-run`, and this workflow can never run green against a feature branch (dependabot/ filter, no workflow_dispatch). Issue #985 research therefore put the new redirect-sync pass inside the script, made it unconditional, and kept its records out of `Verification[].Report.Repair` so the `beyond-known-weak` filter and the YAML stay untouched.
+
+**How to apply:** For any repair-behaviour change, prefer script/module changes over YAML. Note also that `BindingRedirectVerification.Tests.ps1` checks `newVersion` membership in a UNION of all csproj Reference versions, so a stale Reference in one test csproj masks a stale redirect. Packages.config/app.config/csproj are in `.csharpierignore`, so format-check never sees them. Related: [[measure-item-worktree]].
diff --git a/QuickFiler.Test/QuickFiler.Test.csproj b/QuickFiler.Test/QuickFiler.Test.csproj
index 6206c5b6c..ea6697ba8 100644
--- a/QuickFiler.Test/QuickFiler.Test.csproj
+++ b/QuickFiler.Test/QuickFiler.Test.csproj
@@ -525,11 +525,6 @@
       <Name>TaskVisualization</Name>
     </ProjectReference>
   </ItemGroup>
-  <ItemGroup>
-    <Reference Include="Microsoft.Web.WebView2.Core, Version=1.0.4191.47, Culture=neutral, PublicKeyToken=2a8ab48044d2601e, processorArchitecture=MSIL">
-      <HintPath>..\packages\Microsoft.Web.WebView2.1.0.4191.47\lib\net462\Microsoft.Web.WebView2.Core.dll</HintPath>
-    </Reference>
-  </ItemGroup>
   <ItemGroup>
     <Analyzer Include="..\packages\MSTest.Analyzers.4.4.1\analyzers\dotnet\cs\MSTest.Analyzers.CodeFixes.dll" />
     <Analyzer Include="..\packages\MSTest.Analyzers.4.4.1\analyzers\dotnet\cs\MSTest.Analyzers.dll" />
diff --git a/QuickFiler.Test/packages.config b/QuickFiler.Test/packages.config
index df2a75e8e..10eb5fd36 100644
--- a/QuickFiler.Test/packages.config
+++ b/QuickFiler.Test/packages.config
@@ -39,10 +39,12 @@
   <package id="Microsoft.Testing.Platform.MSBuild" version="2.4.1" targetFramework="net481" />
   <package id="Microsoft.TestPlatform.AdapterUtilities" version="18.10.1" targetFramework="net481" />
   <package id="Microsoft.TestPlatform.ObjectModel" version="18.10.1" targetFramework="net481" />
+  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />
   <package id="Moq" version="4.21.0" targetFramework="net481" />
   <package id="MSTest.Analyzers" version="4.4.1" targetFramework="net481" developmentDependency="true" />
   <package id="MSTest.TestAdapter" version="4.4.1" targetFramework="net481" />
   <package id="MSTest.TestFramework" version="4.4.1" targetFramework="net481" />
+  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />
   <package id="OpenTelemetry" version="1.19.1" targetFramework="net481" />
   <package id="OpenTelemetry.Api" version="1.19.1" targetFramework="net481" />
   <package id="OpenTelemetry.Api.ProviderBuilderExtensions" version="1.19.1" targetFramework="net481" />
diff --git a/TaskTree.Test/packages.config b/TaskTree.Test/packages.config
index 0c4b89781..cbe4c2c11 100644
--- a/TaskTree.Test/packages.config
+++ b/TaskTree.Test/packages.config
@@ -38,6 +38,7 @@
   <package id="MSTest.Analyzers" version="4.4.1" targetFramework="net481" developmentDependency="true" />
   <package id="MSTest.TestAdapter" version="4.4.1" targetFramework="net481" />
   <package id="MSTest.TestFramework" version="4.4.1" targetFramework="net481" />
+  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />
   <package id="OpenTelemetry" version="1.19.1" targetFramework="net481" />
   <package id="OpenTelemetry.Api" version="1.19.1" targetFramework="net481" />
   <package id="OpenTelemetry.Api.ProviderBuilderExtensions" version="1.19.1" targetFramework="net481" />
diff --git a/UtilitiesCS.Test/packages.config b/UtilitiesCS.Test/packages.config
index b1d44e24e..cdea2476a 100644
--- a/UtilitiesCS.Test/packages.config
+++ b/UtilitiesCS.Test/packages.config
@@ -61,6 +61,7 @@
   <package id="Microsoft.Testing.Platform.MSBuild" version="2.4.1" targetFramework="net481" />
   <package id="Microsoft.TestPlatform.AdapterUtilities" version="18.10.1" targetFramework="net481" />
   <package id="Microsoft.TestPlatform.ObjectModel" version="18.10.1" targetFramework="net481" />
+  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />
   <package id="Mono.Reflection" version="2.0.0" targetFramework="net481" />
   <package id="Moq" version="4.21.0" targetFramework="net481" />
   <package id="MSTest.Analyzers" version="4.4.1" targetFramework="net481" developmentDependency="true" />
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md
new file mode 100644
index 000000000..c75e0431f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md
@@ -0,0 +1,62 @@
+# Code Review: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Branch: `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`
+- Head: `de397b992868882530a447c662d21b3fbff123eb`
+- Base: `origin/main`, merge base `9911fe138952e2b93476850582847c2831e1cbbd`
+- Review timestamp: 2026-10-09T14-55
+- Scope: full branch diff (70 files): 2 production PowerShell files, 3 PowerShell test files, 1 csproj, 3 `packages.config`, feature documents and evidence, agent-memory index files.
+
+## Executive Summary
+
+The implementation matches the spec's design. `BindingRedirectSync.psm1` keeps the rewrite logic pure over text, injects all I/O through delegates, reuses the existing parser and reconciler so only attribute values change, and is stale-only and idempotent. The composition-root wiring in `Repair-PackageManifestConsistency.ps1` is limited to 20 added lines, places the sync before normalisation, passes `-WhatIf` explicitly, and keeps sync records out of `Verification[].Report.Repair`, so the workflow's `beyond-known-weak` computation is unchanged. Tests pin every behaviour named in AC2 with in-memory fixtures, and the new module is fully line-covered.
+
+The manifest edits are minimal and correct: each new declaration matches the production sibling version and the folder named by the existing HintPaths, and exactly one `Microsoft.Web.WebView2.Core` reference remains in `QuickFiler.Test.csproj`.
+
+One blocking finding (B-1) concerns repository hygiene in a committed plan document, not code. The remaining items are non-blocking observations about edge behaviour and documentation drift outside the permitted write set.
+
+Blocking findings: 1 (autonomous). Non-blocking findings: 6.
+
+## Findings Table
+
+| Severity | File | Location | Finding | Recommendation | Rationale | Evidence |
+|---|---|---|---|---|---|---|
+| Blocking | `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md` | line 26 (`SCRATCH` definition) | The encoded session-scratchpad directory name written in the plan contains the operator account name. The plan deliberately avoided a drive-rooted path but the account name survives inside the encoded segment. | Replace the encoded directory name with a placeholder (for example `<session-scratchpad>` or `...\claude\<encoded-worktree>\<session-id>\scratchpad`) in both occurrences on that line; re-sweep the branch diff case-insensitively for the account name. | The shared host-identifier rule prohibits an account name in any committed file; precedent #752 treated an equivalent residue as blocking. | Reviewer case-insensitive sweep of added lines in `git diff 9911fe138...HEAD`: 1 hit, this line only. |
+| Minor | `scripts/dependencies/BindingRedirectSync.psm1` | `Invoke-BindingRedirectSync`, target selection (lines 128-144) | When the stale `newVersion` is higher than every deployed version, the `HighestDeployed` rule rewrites the redirect downward. The report line (`From to To`) does not distinguish a downgrade from an upgrade. | Consider marking a downgrade in the repair record or the report block (for example a `Direction` field) in a follow-up, so a reviewer of the Dependabot PR body can see it. | Behaviour is consistent with the existing `BindingRedirectVerification` invariant (every `newVersion` must equal a csproj Reference version), so it is not a defect; visibility of a downgrade would aid review. | Code read; live-tree `-WhatIf` run produced 0 sync changes on main (`evidence/other/whatif-live-tree.2026-10-09T14-21.md`). |
+| Minor | `.github/workflows/dependabot-repair.yml` | lines 87-94 and 99-105 (comments) | The workflow comments state that the binding-redirect class is not reachable from the `workflow_run` trigger. After this change, app.config redirects are rewritten on every run by the sync pass; the comment remains accurate only for the per-project `Report.Repair` records. | Update the comment in a separate change that can satisfy `modified-workflow-needs-green-run` (the spec excludes workflow edits from this item). File a follow-up issue. | Comment drift can mislead a future editor of the `beyond-known-weak` filter. | Workflow read at the cited lines; spec Scope & Non-Goals excludes `.github/workflows/**`. |
+| Minor | `scripts/dependencies/Repair-PackageManifestConsistency.ps1` | lines 449-457 | `WrittenPath` can carry the same app.config path twice if both the sync pass and the normalisation pass rewrite it. | Optionally de-duplicate `$written` before publishing `WrittenPath`. | Harmless for `git add --update` and for the `written-count != '0'` gate, but the count overstates distinct files. The same pattern pre-exists for the `-CandidateUpgrade` path. | Code read. |
+| Info | `scripts/dependencies/BindingRedirectSync.psm1` | line 121 (`$handled.Contains`) | Duplicate-name detection uses `List[string].Contains`, which is ordinal and case-sensitive, while assembly names in configuration are matched case-insensitively. A second block differing only in case would be processed again; the result is an extra, redundant repair record. No dedicated test covers the duplicate-name branch (the line is covered because the `if` executes). | Optionally use a case-insensitive `HashSet[string]` and add one `It` with two blocks for the same name. | Low impact; no such duplicate exists in the tree. | Code read; coverage line 121 hit. |
+| Info | `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` | new `It` (lines 92-116) | The gate reads real repository files with `[System.IO.File]::ReadAllText`. This is a repository-invariant test, consistent with the existing Import gate in the same file, and creates no file. | None. | Reading tracked repository content is not a temporary-file use. | Code read; fail-before 7 findings, pass-after 0 (`evidence/regression-testing/`). |
+| Info | `docs/features/active/.../evidence/qa-gates/ps-coverage.2026-10-09T14-26.md` | `FILE-COVERAGE` lines | Paths render as `scripts/dependencies/dependencies/<file>` (the helper concatenates the coverage root with the JaCoCo package-relative name). Figures are correct. | Cosmetic; no action required for this item. | Reviewer re-run gives identical per-file figures. | In-session Pester coverage re-run. |
+
+## Detailed Notes
+
+### Module design (`BindingRedirectSync.psm1`)
+
+- Separation of concerns: `Invoke-BindingRedirectSync` is pure over text with provider delegates; `Invoke-SolutionBindingRedirectSync` owns discovery, reading and writing through injected delegates and honours `ShouldProcess`.
+- Invariant preservation: rewrites go through `Invoke-BindingRedirectReconciliation`; the CRLF byte-identity test proves that only the two attribute values change.
+- Exclusion of restore and build output directories in `Test-SyncProjectPath` mirrors `Get-PackageManifestPath` and is exercised by the `packages\log4net.3.4.0\Restored.csproj` fixture, which would otherwise change the deployed set.
+- The listing is captured once and replayed, avoiding repeated directory enumeration.
+- Nested imports omit `-Force`, with a comment explaining why; consistent with `BindingRedirectVerification.psm1`.
+
+### Composition root (`Repair-PackageManifestConsistency.ps1`)
+
+- `$projectTextOverride` records the post-repair project text for every project, including `-WhatIf` runs, so the sync sees repaired references without reading disk.
+- The new `RedirectSync` field is additive; existing result fields keep their meaning. `Body` gains the sync block only when repairs exist.
+- File length 493 lines, within the 500-line limit with little remaining headroom; future additions should go into modules.
+
+### Manifests and project file
+
+- `QuickFiler.Test`: WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1 inserted in id order with `targetFramework="net481"`.
+- `UtilitiesCS.Test`: WebView2 1.0.4191.47.
+- `TaskTree.Test`: ObjectListView.Official 2.9.1.
+- `QuickFiler.Test.csproj`: the trailing duplicate `ItemGroup` (Reference at the 4191.47 HintPath) removed; the primary reference at line 389 remains.
+
+### Integration behaviour
+
+The rehearsal on the PR #984 branch (`evidence/other/integration-rehearsal.2026-10-09T14-35.md`) shows the sync rewriting the five transitive log4net redirects and, additionally, the two test-project WebView2.Core redirects (rule `OwnReference`), followed by clean analyzer and nullable rebuilds and a passing `BindingRedirectVerification` suite; an immediate re-run writes nothing. The rehearsal simulated the Dependabot bump of the two newly declared test-project WebView2 entries; the real behaviour on `@dependabot recreate` is what AC7 verifies.
+
+## Toolchain Verification
+
+- PowerShell: format, analyze and test pass (executor, iteration 2). Reviewer in-session Pester run over `tests/scripts/dependencies` with coverage: 178 passed, 0 failed; `BindingRedirectSync.psm1` 100.00% lines.
+- C#: CSharpier check, analyzer rebuild, nullable rebuild and MSTest with coverage pass (executor, iteration 1). No `.cs` file changed.
+- Typed-Python review: not applicable; no Python file changed on the branch.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T15-35.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T15-35.md
new file mode 100644
index 000000000..dd427a274
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T15-35.md
@@ -0,0 +1,58 @@
+# Code Review: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Branch: `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`
+- Head: `07d3a8a982d605eeb3bca77810955b4de5773ea8`
+- Base: `origin/main`, merge base `9911fe138952e2b93476850582847c2831e1cbbd`
+- Review timestamp: 2026-10-09T15-35 (re-audit after remediation cycle R1)
+- Scope: full branch diff (107 files): 2 production PowerShell files, 3 PowerShell test files, 1 csproj, 3 `packages.config`, feature documents, evidence, review artifacts, a promoted potential record, agent-memory files.
+
+## Executive Summary
+
+The cycle-0 implementation assessment stands: `BindingRedirectSync.psm1` is pure over text with injected I/O, reuses the existing parser and reconciler, and is stale-only and idempotent; the composition-root wiring is minimal and keeps sync records out of `Verification[].Report.Repair`; the manifest edits match the production sibling versions.
+
+The R1 commit `07d3a8a98` closes the prior blocking finding and the three in-scope code observations:
+
+- B-1: the encoded scratchpad segment in `plan.2026-10-09T13-06.md` line 26 is replaced by `<encoded-worktree>\<session-id>`. A reviewer sweep of every added line finds no host identifier.
+- CR-1: `Get-RedirectDirection` (private, not exported) classifies each rewrite as `Upgrade`, `Downgrade` or `Unknown` with `[System.Version]::TryParse`; the record carries `Direction` and the report line ends `(<Rule>, <Direction>)`. No consumer in `.github/` or `scripts/` parses the report line, so the format change breaks nothing.
+- CR-2: `WrittenPath` is filtered through an `OrdinalIgnoreCase` `HashSet[string]`, keeping first-occurrence order and the `[string[]]` type.
+- CR-3: the handled-name set is an `OrdinalIgnoreCase` `HashSet[string]`, with a single `Add` test replacing `Contains` plus `Add`.
+
+Each change has a fail-before run that failed for the stated reason (7 and 2 failures) and a pass-after run; the reviewer's in-session run gives 447/447 and 100% line coverage of the module.
+
+Blocking findings: 0. Non-blocking findings: 4 (Info).
+
+## Findings Table
+
+| Severity | File | Location | Finding | Recommendation | Rationale | Evidence |
+|---|---|---|---|---|---|---|
+| Info | `scripts/dependencies/BindingRedirectSync.psm1` | `Get-RedirectDirection` (lines 76-91) | `[System.Version]` treats an absent build or revision component as -1, so a two-part value such as `3.5` compares lower than `3.5.0.0` and the pair is reported as `Upgrade`, although the versions are numerically equal in assembly-binding terms. | None required for this item. If two-part values appear in practice, normalise both values to four components before comparing. | Deployed versions come from csproj `Reference` `Version=` attributes, which are four-part; the outcome affects only the report label, not the rewrite. | Reviewer check: `[version]'3.5' -lt [version]'3.5.0.0'` returns `True`. |
+| Info | `artifacts/pester/powershell-coverage.xml` (not committed) | whole document | The bundled PoshQC coverage document regenerated by the R1 MCP test run again reports 0/10477 lines and no package under `scripts/`. | Track as a PoshQC tooling defect outside this item; direct Pester coverage governs. | Pre-existing; recorded as O-1 in the prior review. | Reviewer `[xml]` parse of the document. |
+| Info | `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-plan.2026-10-09T14-55.md` | line 7 (`Status:`) | The status line still reads `Draft (planner round 1; awaiting executor preflight)` while every task checkbox is `[x]`. | Optionally update the status line when the feature folder is next edited. | Documentation accuracy only. | File read. |
+| Info | outside the repository | rehearsal worktree and local branch `rehearsal-985-throwaway` | The cycle-0 rehearsal worktree and local branch still exist. | Remove with the repository's worktree cleanup script after merge. | Local state only; no remote branch exists. | `git worktree list --porcelain`; `git branch --list 'rehearsal-985*'`. |
+
+## Detailed Notes
+
+### R1 production changes
+
+- `Get-RedirectDirection` declares `[CmdletBinding()]`, `[OutputType([string])]` and mandatory typed parameters, returns early for the two ordered cases and falls through to `Unknown`. It is absent from `Export-ModuleMember`.
+- The handled-name comment states why the comparison is case-insensitive (assembly names bind case-insensitively), which matches `Invoke-BindingRedirectReconciliation` already rewriting every case variant on the first record; the second record previously produced only a redundant repair record.
+- `$distinctWritten` is created after the body is composed and consumed once inside the result literal; the `WrittenPath` count can only fall, so the workflow's non-zero written-count gate is unaffected.
+- Help text in `.DESCRIPTION` and both `.OUTPUTS` sections is updated to match.
+- Line counts after R1: module 328, repair script 495 (within the 500-line limit; the script has 5 lines of headroom, so further additions should go into modules).
+
+### R1 tests
+
+- N1 to N4 pin the three `Direction` outcomes, including the numerically equal `3.05.0.0` and `3.5.0.0` pair and an unparsable stale value.
+- N5 asserts one repair record, two examined entries and both blocks rewritten, which separates the skip from the rewrite.
+- N8 guards N9: it proves both passes wrote the fixture before N9 asserts a single `WrittenPath` entry, so N9 cannot pass because only one pass ran.
+- The modified report test and N6 assert exact lines.
+
+### Manifests, project file and integration
+
+Unchanged since the prior review; see `code-review.2026-10-09T14-55.md` and `evidence/other/integration-rehearsal.2026-10-09T14-35.md`.
+
+## Toolchain Verification
+
+- PowerShell: format (no rewrite), analyze and MCP test pass (executor R1 iteration 1). Reviewer in-session Pester run over `tests/scripts/{dependencies,hygiene,vscode}` with coverage of `scripts/{dependencies,hygiene,vscode}`: 447 passed, 0 failed; aggregate 94.99% lines; module 100.00% (120/120); repair script 94.17% (226/240).
+- C#: R1 changed no C#-family file; cycle-0 CSharpier check, analyzer rebuild, nullable rebuild and MSTest (7427/7427) remain the record.
+- Typed-Python review: not applicable; no Python file changed on the branch.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-analyzers.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-analyzers.2026-10-09T14-04.md
new file mode 100644
index 000000000..7cb2d20d0
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-analyzers.2026-10-09T14-04.md
@@ -0,0 +1,15 @@
+# C# Baseline Analyzers (P0-T11)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot WORKSPACE-ROOT -Gate Analyzers -LogName 985-baseline-analyzers.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true)
+EXIT_CODE: 0
+Output Summary:
+- EXIT_CODE: 0
+- OUTPUT-ASSEMBLIES: 18
+- SUMMARY: 0 Warning(s)
+- SUMMARY: 0 Error(s)
+- ERROR-LINE-COUNT: 0
+- PATH-LENGTH-SIGNATURE-LINES: 0
+- BASELINE-OUTPUT-ASSEMBLIES: 18
+- Log kept at coverage/985-baseline-analyzers.log (ignored directory).
+- Result: analyzer baseline green; no CS-BASELINE-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-format.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-format.2026-10-09T14-04.md
new file mode 100644
index 000000000..d5fefa3c8
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-format.2026-10-09T14-04.md
@@ -0,0 +1,10 @@
+# C# Baseline Format (P0-T9)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File WORKSPACE-ROOT\scripts\vscode\Install-RepoDotNetSdk.ps1; pwsh -NoProfile -File CMDDIR\985-csharpier.ps1 -WorkspaceRoot WORKSPACE-ROOT -Mode restore; pwsh -NoProfile -File CMDDIR\985-csharpier.ps1 -WorkspaceRoot WORKSPACE-ROOT -Mode check
+EXIT_CODE: 0
+Output Summary:
+- SDK-INSTALL-EXIT_CODE: 0 (Installed repo-local .NET SDK 8.0.205 to WORKSPACE-ROOT\.dotnet-sdk, ignored by .gitignore `.dotnet*/`)
+- restore: COMMAND dotnet tool restore; EXIT_CODE 0; Tool 'csharpier' (version '1.2.6') was restored; Restore was successful.
+- check: COMMAND dotnet tool run csharpier check .; EXIT_CODE 0; Checked 1650 files in 4288ms.
+- Result: C# format baseline green (read-only check); no CS-BASELINE-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-nullable.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-nullable.2026-10-09T14-04.md
new file mode 100644
index 000000000..c24823522
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-nullable.2026-10-09T14-04.md
@@ -0,0 +1,14 @@
+# C# Baseline Type-check (P0-T12)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot WORKSPACE-ROOT -Gate Nullable -LogName 985-baseline-nullable.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true)
+EXIT_CODE: 0
+Output Summary:
+- EXIT_CODE: 0
+- OUTPUT-ASSEMBLIES: 18 (equal to BASELINE-OUTPUT-ASSEMBLIES 18)
+- SUMMARY: 0 Warning(s)
+- SUMMARY: 0 Error(s)
+- ERROR-LINE-COUNT: 0
+- PATH-LENGTH-SIGNATURE-LINES: 0
+- Log kept at coverage/985-baseline-nullable.log (ignored directory).
+- Result: nullable baseline green; no CS-BASELINE-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-restore.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-restore.2026-10-09T14-04.md
new file mode 100644
index 000000000..c939afbdf
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-restore.2026-10-09T14-04.md
@@ -0,0 +1,9 @@
+# C# Baseline Restore (P0-T10)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File CMDDIR\985-restore.ps1 -WorkspaceRoot WORKSPACE-ROOT (runs nuget restore TaskMaster.sln -NonInteractive)
+EXIT_CODE: 0
+Output Summary:
+- EXIT_CODE: 0; LINE-COUNT: 539
+- TAIL: Installed: 173 package(s) to packages.config projects
+- Result: restore succeeded; no CS-BASELINE-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-test.2026-10-09T14-11.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-test.2026-10-09T14-11.md
new file mode 100644
index 000000000..6eb3da14e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/cs-test.2026-10-09T14-11.md
@@ -0,0 +1,19 @@
+# C# Baseline Tests with Coverage (P0-T13)
+
+Timestamp: 2026-10-09T14-11
+Command: pwsh -NoProfile -File CMDDIR\985-mstest.ps1 -WorkspaceRoot WORKSPACE-ROOT -EvidencePrefix WORKSPACE-ROOT\FEATURE\evidence\baseline\mstest-coverage-baseline.2026-10-09T14-11
+EXIT_CODE: 0
+Output Summary:
+- SHELL-ICON-EXCLUSION: APPLIED ShellUtilities_Tests ShellUtilitiesStatic_Tests SysImageListHelperTests OSBrowser_Tests (route D3; CI runs the full set)
+- Discovered 9 test assemblies.
+- First-party coverage: lines 56496/66143 (85.41%), branches 13709/17173 (79.83%)
+- RUNNER_RESULT=COMPLETED (C7 flaky rule did not apply)
+- TRX-SUMMARY: Test run outcome: Completed
+- TRX-SUMMARY: Total 7427, executed 7427, passed 7427, failed 0.
+- TRX-SUMMARY: Skipped 0, derived as total minus executed rather than reported by the test platform.
+- TRX-SUMMARY: Figures reported verbatim by the test platform: error 0, timeout 0, aborted 0, notExecuted 0, inconclusive 0.
+- TRX-SUMMARY: Failed tests: none
+- PROJECTION-COPIED; copies present: mstest-coverage-baseline.2026-10-09T14-11.summary.txt and mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml (beside this file)
+- BASELINE-CS-LINE: 85.41
+- BASELINE-CS-BRANCH: 79.83
+- Result: baseline green; no BASELINE-TEST-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/git-and-tools.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/git-and-tools.2026-10-09T14-04.md
new file mode 100644
index 000000000..8354b804b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/git-and-tools.2026-10-09T14-04.md
@@ -0,0 +1,47 @@
+# Git State and Tool Availability (P0-T2)
+
+Timestamp: 2026-10-09T14-04
+Command: git rev-parse --abbrev-ref HEAD; git rev-parse HEAD; git merge-base HEAD origin/main; git diff --name-only BASE-SHA HEAD; git status --porcelain; pwsh -NoProfile -File CMDDIR\985-probe.ps1 -RehearsalRoot REHEARSAL
+EXIT_CODE: 0
+Output Summary:
+- BRANCH: bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985 (equals FIX-BRANCH)
+- HEAD: 9911fe138952e2b93476850582847c2831e1cbbd
+- BASE-SHA: 9911fe138952e2b93476850582847c2831e1cbbd
+- Committed diff BASE-SHA..HEAD: empty (no committed path outside the permitted set)
+- Probe: PWSH-VERSION 7.6.6; PESTER-AVAILABLE 5.6.1; NUGET FOUND (NuGet Version: 7.6.0.59); VSWHERE True; MSBUILD FOUND; DOTNET-COVERAGE FOUND; LONG-PATHS-ENABLED 1; REHEARSAL-ROOT-LENGTH 162
+- Result: all required tools present; no STOP condition.
+
+## git diff --name-only BASE-SHA HEAD
+
+(empty)
+
+## PreExistingWorktreePaths:
+
+```
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/task-researcher/MEMORY.md
+?? .claude/agent-memory/atomic-executor/index_overflow_entries.md
+?? .claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md
+?? .claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md
+?? .claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md
+?? .claude/agent-memory/task-researcher/index_epic136_percoverage_children.md
+?? .claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md
+?? .claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/
+?? docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md
+```
+
+## Probe output (985-probe.ps1)
+
+```
+PWSH-VERSION: 7.6.6
+PESTER-AVAILABLE: 5.6.1
+NUGET: FOUND
+NUGET-VERSION: NuGet Version: 7.6.0.59
+VSWHERE: True
+MSBUILD: FOUND
+DOTNET-COVERAGE: FOUND
+LONG-PATHS-ENABLED: 1
+REHEARSAL-ROOT-LENGTH: 162
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/helper-scripts.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/helper-scripts.2026-10-09T14-04.md
new file mode 100644
index 000000000..b8189a64c
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/helper-scripts.2026-10-09T14-04.md
@@ -0,0 +1,20 @@
+# Helper Scripts (P0-T3)
+
+Timestamp: 2026-10-09T14-04
+Command: git hash-object --no-filters CMDDIR\985-probe.ps1 CMDDIR\985-restore.ps1 CMDDIR\985-csharpier.ps1 CMDDIR\985-msbuild.ps1 CMDDIR\985-mstest.ps1 CMDDIR\985-pester.ps1 CMDDIR\985-junit.ps1 CMDDIR\985-repair.ps1 CMDDIR\985-nuget-update.ps1
+EXIT_CODE: 0
+Output Summary:
+- Nine helper scripts written verbatim from plan section 5 into CMDDIR (outside the repository), each with Format-SafeLine pasted after its param block.
+- Nine hashes recorded below; P8-T1 re-checks them.
+
+| Script | git hash-object --no-filters |
+|---|---|
+| 985-probe.ps1 | fd56601d907546ef6b0f2d4b374d22cca441eb56 |
+| 985-restore.ps1 | 96658345a6001e5c22b5e5b4174404edbff12127 |
+| 985-csharpier.ps1 | 4436583817876b8c12d968489805c1655f46ddfb |
+| 985-msbuild.ps1 | 7b80d637d6f7abccbf4df86877ac561fc0a0c6dc |
+| 985-mstest.ps1 | f45cc585940fd1efe2c0b409573b5c815e2fe7d8 |
+| 985-pester.ps1 | 74ddc15e1a935c4b5dbd0efa4a72b63d9fcc0913 |
+| 985-junit.ps1 | 4df03fc0b964ac2d337c37141a5266f89b5c96a3 |
+| 985-repair.ps1 | 5cc7c5caaa7f90e37076de4ead07ce66332fe948 |
+| 985-nuget-update.ps1 | cb461c5cfd131c592f587cc6b583d468239280ea |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml
new file mode 100644
index 000000000..aa3a94835
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml
@@ -0,0 +1,38 @@
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="2293" covered="10468" />
+    <counter type="BRANCH" missed="699" covered="2518" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="4603" covered="39160" />
+    <counter type="BRANCH" missed="1866" covered="9518" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="143" covered="1426" />
+    <counter type="BRANCH" missed="67" covered="333" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="977" covered="877" />
+    <counter type="BRANCH" missed="338" covered="300" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="762" covered="1061" />
+    <counter type="BRANCH" missed="260" covered="248" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="56" covered="702" />
+    <counter type="BRANCH" missed="16" covered="174" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="802" covered="2503" />
+    <counter type="BRANCH" missed="210" covered="524" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="11" covered="295" />
+    <counter type="BRANCH" missed="8" covered="94" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="4" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.summary.txt b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.summary.txt
new file mode 100644
index 000000000..100bb2604
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.summary.txt
@@ -0,0 +1,5 @@
+Test run outcome: Completed
+Total 7427, executed 7427, passed 7427, failed 0.
+Skipped 0, derived as total minus executed rather than reported by the test platform.
+Figures reported verbatim by the test platform: error 0, timeout 0, aborted 0, notExecuted 0, inconclusive 0.
+Failed tests: none
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/phase0-instructions-read.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/phase0-instructions-read.md
new file mode 100644
index 000000000..f5414b05b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/phase0-instructions-read.md
@@ -0,0 +1,25 @@
+# Phase 0 Instructions Read (Issue #985)
+
+Timestamp: 2026-10-09T14-04
+
+Policy Order: CLAUDE.md, then .claude/rules/general-code-change.md, then .claude/rules/general-unit-test.md, then the domain rules (.claude/rules/quality-tiers.md, .claude/rules/powershell.md, .claude/rules/csharp.md, .claude/rules/tonality.md, .claude/rules/plan-acceptance-gates.md), then the skills (atomic-plan-contract, evidence-and-timestamp-conventions, acceptance-criteria-tracking), then the feature documents (issue.md, spec.md, research).
+
+Files Read:
+1. CLAUDE.md
+2. .claude/rules/general-code-change.md
+3. .claude/rules/general-unit-test.md
+4. .claude/rules/quality-tiers.md
+5. .claude/rules/powershell.md
+6. .claude/rules/csharp.md
+7. .claude/rules/tonality.md
+8. .claude/rules/plan-acceptance-gates.md
+9. .claude/skills/atomic-plan-contract/SKILL.md
+10. .claude/skills/evidence-and-timestamp-conventions/SKILL.md
+11. .claude/skills/acceptance-criteria-tracking/SKILL.md
+12. docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/issue.md
+13. docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md
+14. docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/research/research.2026-10-09T14-10.md
+
+Notes:
+- Work Mode (issue.md): full-bug; AC source is spec.md only (AC1 to AC7).
+- Coverage floors applied per plan D6: CLAUDE.md UT2 (line 80, new code 90) takes precedence over the 85 figure in quality-tiers.md, which is recorded as an observation.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/post-baseline-porcelain.2026-10-09T14-13.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/post-baseline-porcelain.2026-10-09T14-13.md
new file mode 100644
index 000000000..c74051808
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/post-baseline-porcelain.2026-10-09T14-13.md
@@ -0,0 +1,27 @@
+# Post-baseline Porcelain Check (P0-T14)
+
+Timestamp: 2026-10-09T14-13
+Command: git status --porcelain
+EXIT_CODE: 0
+Output Summary:
+- 12 porcelain lines; identical to PreExistingWorktreePaths recorded in git-and-tools.2026-10-09T14-04.md.
+- AGENT-MEMORY-LINES: 10 (3 modified MEMORY.md files, 7 untracked memory files; listed below)
+- Non-agent-memory lines: the FEATURE folder (untracked, holds the new evidence) and docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md; both pre-existing.
+- No tracked file modified by the baseline build, restore or test steps (QuickFiler.Test/QuickFiler.Test.csproj unchanged); nothing reverted.
+
+## Porcelain
+
+```
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/task-researcher/MEMORY.md
+?? .claude/agent-memory/atomic-executor/index_overflow_entries.md
+?? .claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md
+?? .claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md
+?? .claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md
+?? .claude/agent-memory/task-researcher/index_epic136_percoverage_children.md
+?? .claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md
+?? .claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/
+?? docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-analyze.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-analyze.2026-10-09T14-04.md
new file mode 100644
index 000000000..d7bfbfc7d
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-analyze.2026-10-09T14-04.md
@@ -0,0 +1,10 @@
+# PowerShell Baseline Lint (P0-T6)
+
+Timestamp: 2026-10-09T14-04
+Command: mcp__drm-copilot__run_poshqc_analyze workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true
+- MCP summary: Ran bundled PoshQC analyze against 'WORKSPACE-ROOT' with 2 selected scan folder(s).
+- Type checking: not applicable to PowerShell (.claude/rules/powershell.md toolchain step 3).
+- Result: baseline lint green; no ANALYZE-BASELINE-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-coverage.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-coverage.2026-10-09T14-04.md
new file mode 100644
index 000000000..e03386c4f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-coverage.2026-10-09T14-04.md
@@ -0,0 +1,57 @@
+# PowerShell Baseline Direct Coverage (P0-T8)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985-pester-baseline.xml
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 3; COVERAGE-PATH-COUNT: 3; PESTER-VERSION: 5.6.1
+- PESTER Passed=413 Failed=0 Skipped=0 NotRun=0 Total=413
+- COVERAGE LinePercent=94.64 Covered=1765 Total=1865
+- FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=93.83 Covered=213 Total=227
+- BASELINE-PS-AGGREGATE: 94.64
+- BASELINE-REPAIR-SCRIPT-LINE: 93.83
+- Raw JaCoCo document kept at coverage/985-pester-baseline.xml (ignored directory); not copied into the feature folder.
+- Result: baseline green; no BASELINE-TEST-RED.
+
+## FILE-TESTS lines
+
+```
+FILE-TESTS AnalyzerItemRepair.Tests.ps1 Passed=13 Failed=0 Total=13
+FILE-TESTS BindingRedirectVerification.Tests.ps1 Passed=16 Failed=0 Total=16
+FILE-TESTS ConsistencyVerifier.Tests.ps1 Passed=14 Failed=0 Total=14
+FILE-TESTS DependabotConfig.Tests.ps1 Passed=17 Failed=0 Total=17
+FILE-TESTS Install-RepoDotNetSdk.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Invoke-MSTest.AssemblyDiscovery.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Invoke-MSTest.Main.Tests.ps1 Passed=12 Failed=0 Total=12
+FILE-TESTS Invoke-MSTest.ResultsDirectory.Tests.ps1 Passed=3 Failed=0 Total=3
+FILE-TESTS Invoke-MSTest.RunSettings.Tests.ps1 Passed=28 Failed=0 Total=28
+FILE-TESTS Invoke-MSTest.TrxSummary.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-MSTestWithCoverage.AssemblyDiscovery.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Invoke-MSTestWithCoverage.ClosureFilter.Tests.ps1 Passed=12 Failed=0 Total=12
+FILE-TESTS Invoke-MSTestWithCoverage.FirstParty.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-MSTestWithCoverage.Helpers.Tests.ps1 Passed=20 Failed=0 Total=20
+FILE-TESTS Invoke-MSTestWithCoverage.Merge.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Invoke-MSTestWithCoverage.PackageRate.Tests.ps1 Passed=2 Failed=0 Total=2
+FILE-TESTS Invoke-MSTestWithCoverage.Projection.Tests.ps1 Passed=11 Failed=0 Total=11
+FILE-TESTS Invoke-MSTestWithCoverage.ResultsDirectory.Tests.ps1 Passed=9 Failed=0 Total=9
+FILE-TESTS Invoke-MSTestWithCoverage.Scope.Tests.ps1 Passed=22 Failed=0 Total=22
+FILE-TESTS Invoke-MSTestWithCoverage.Threshold.Tests.ps1 Passed=13 Failed=0 Total=13
+FILE-TESTS Invoke-Restore.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-VSBuild.Tests.ps1 Passed=16 Failed=0 Total=16
+FILE-TESTS PackageCompatibility.Tests.ps1 Passed=8 Failed=0 Total=8
+FILE-TESTS PackageGraph.Tests.ps1 Passed=32 Failed=0 Total=32
+FILE-TESTS ProjectConsistency.Tests.ps1 Passed=18 Failed=0 Total=18
+FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31
+FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=4 Failed=0 Total=4
+FILE-TESTS Sync-PackageReferences.Tests.ps1 Passed=15 Failed=0 Total=15
+FILE-TESTS Test-RepositoryHygiene.Git.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Test-RepositoryHygiene.Rules.Tests.ps1 Passed=29 Failed=0 Total=29
+FILE-TESTS Test-RepositoryHygiene.Tests.ps1 Passed=15 Failed=0 Total=15
+FILE-TESTS TestProcessCleanup.Tests.ps1 Passed=5 Failed=0 Total=5
+```
+
+## FILE-COVERAGE (Repair script)
+
+```
+FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=93.83 Covered=213 Total=227
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-format.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-format.2026-10-09T14-04.md
new file mode 100644
index 000000000..d2272205b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-format.2026-10-09T14-04.md
@@ -0,0 +1,12 @@
+# PowerShell Baseline Format (P0-T5)
+
+Timestamp: 2026-10-09T14-04
+Command: mcp__drm-copilot__run_poshqc_format workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true
+- MCP summary: Ran bundled PoshQC format against 'WORKSPACE-ROOT' with 2 selected scan folder(s).
+- Porcelain before and after: identical (12 lines, all pre-existing; listed in git-and-tools.2026-10-09T14-04.md).
+- scripts/dependencies/Repair-PackageManifestConsistency.ps1 hash before e3029f6ba072f6198c40fe985ebfe0e29c261889, after e3029f6ba072f6198c40fe985ebfe0e29c261889 (identical)
+- tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 hash before 1167a0be9a5c30f8a13ec44331b7c06bdcd9369f, after 1167a0be9a5c30f8a13ec44331b7c06bdcd9369f (identical)
+- Result: no rewrite; no BASELINE-FORMAT-DRIFT.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-test-mcp.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-test-mcp.2026-10-09T14-04.md
new file mode 100644
index 000000000..b65924c7f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/ps-test-mcp.2026-10-09T14-04.md
@@ -0,0 +1,19 @@
+# PowerShell Baseline MCP Test (P0-T7)
+
+Timestamp: 2026-10-09T14-04
+Command: pwsh -NoProfile -File CMDDIR\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT -Clear; mcp__drm-copilot__run_poshqc_test workspace_root = WORKSPACE-ROOT, scan_folders = [tests/scripts/dependencies]; pwsh -NoProfile -File CMDDIR\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT
+EXIT_CODE: 0
+Output Summary:
+- JUNIT-CLEARED: True
+- MCP ok: true; summary: Ran bundled PoshQC test against 'WORKSPACE-ROOT' with 1 selected scan folder(s).
+- JUNIT tests=153 failures=0 errors=0 disabled=0
+- JUNIT-SUITE AnalyzerItemRepair.Tests.ps1 tests=13 failures=0
+- JUNIT-SUITE BindingRedirectVerification.Tests.ps1 tests=16 failures=0
+- JUNIT-SUITE ConsistencyVerifier.Tests.ps1 tests=14 failures=0
+- JUNIT-SUITE DependabotConfig.Tests.ps1 tests=17 failures=0
+- JUNIT-SUITE PackageCompatibility.Tests.ps1 tests=8 failures=0
+- JUNIT-SUITE PackageGraph.Tests.ps1 tests=32 failures=0
+- JUNIT-SUITE ProjectConsistency.Tests.ps1 tests=18 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.Tests.ps1 tests=31 failures=0
+- JUNIT-SUITE RepositoryTreeConsistency.Tests.ps1 tests=4 failures=0
+- Result: baseline green; no BASELINE-TEST-RED.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/tree-facts.2026-10-09T14-04.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/tree-facts.2026-10-09T14-04.md
new file mode 100644
index 000000000..b91abd5ed
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/baseline/tree-facts.2026-10-09T14-04.md
@@ -0,0 +1,26 @@
+# Pre-change Tree Facts (P0-T4)
+
+Timestamp: 2026-10-09T14-04
+Command: Grep tool (count mode) with patterns `^`, `\r$`, `id="Microsoft\.Web\.WebView2"|id="ObjectListView\.Official"`, `Include="Microsoft\.Web\.WebView2\.Core,`; Glob for the three new files
+EXIT_CODE: 0
+Output Summary:
+- Every observed value equals the plan's expected value; no anchor re-derivation needed.
+
+| Fact | Expected | Observed |
+|---|---|---|
+| QuickFiler.Test/packages.config lines | 74 | 74 |
+| UtilitiesCS.Test/packages.config lines | 110 | 110 |
+| TaskTree.Test/packages.config lines | 69 | 69 |
+| QuickFiler.Test/QuickFiler.Test.csproj lines | 572 | 572 |
+| scripts/dependencies/Repair-PackageManifestConsistency.ps1 lines | 475 | 475 |
+| tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 lines | 152 | 152 |
+| QuickFiler.Test/packages.config CR count | 73 | 73 |
+| UtilitiesCS.Test/packages.config CR count | 109 | 109 |
+| TaskTree.Test/packages.config CR count | 68 | 68 |
+| WebView2/ObjectListView declarations: QuickFiler.Test | 0 | 0 |
+| WebView2/ObjectListView declarations: UtilitiesCS.Test | 1 (line 70 ObjectListView.Official) | 1 (line 70 ObjectListView.Official 2.9.1) |
+| WebView2/ObjectListView declarations: TaskTree.Test | 0 | 0 |
+| `Include="Microsoft.Web.WebView2.Core,` in QuickFiler.Test.csproj | 2 | 2 (lines 388, 529) |
+| scripts/dependencies/BindingRedirectSync.psm1 | absent | absent (Glob none; control Glob for BindingRedirect*.psm1 returned BindingRedirectVerification.psm1) |
+| tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 | absent | absent |
+| tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 | absent | absent |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/ac-status.2026-10-09T14-49.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/ac-status.2026-10-09T14-49.md
new file mode 100644
index 000000000..4efad5557
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/ac-status.2026-10-09T14-49.md
@@ -0,0 +1,47 @@
+# Acceptance Criteria Status (P8-T1)
+
+Timestamp: 2026-10-09T14-49
+Command: Grep `^- \[(x| )\] AC[0-9] ` over FEATURE/spec.md; git hash-object --no-filters over the nine CMDDIR helper scripts
+EXIT_CODE: 0
+Output Summary:
+- Grep `^- \[x\] AC[1-6] ` count 6; `^- \[ \] AC7 ` count 1.
+- Helper-script hashes re-read and equal to P0-T3 (helper-scripts.2026-10-09T14-04.md) for all nine scripts.
+
+### Acceptance Criteria Status
+- Source: FEATURE/spec.md
+- Total AC items: 7
+- Checked off (delivered): 6
+- Remaining (unchecked): 1
+- Items remaining: AC7
+
+AC7: PENDING-CI (checked off by the item's orchestrator after merge and @dependabot recreate on PR #984; D7)
+
+## Check-off citations
+
+| AC | Evidence |
+|---|---|
+| AC1 | evidence/other/manifest-edit-facts.2026-10-09T14-17.md; evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md |
+| AC2 | evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md; evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md; evidence/qa-gates/ps-coverage.2026-10-09T14-26.md |
+| AC3 | evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md; evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md |
+| AC4 | evidence/qa-gates/workflows-untouched.2026-10-09T14-31.md (P8-T2 repeats the committed-range form) |
+| AC5 | evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md; evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md; PowerShell loop iteration 2 and C# loop iteration 1 artifacts |
+| AC6 | evidence/other/integration-rehearsal.2026-10-09T14-35.md (REHEARSAL-VERDICT: PASS) |
+| AC7 | pending CI |
+
+## Helper-script hashes (P0-T3 versus now)
+
+| Script | P0-T3 | Now |
+|---|---|---|
+| 985-probe.ps1 | fd56601d907546ef6b0f2d4b374d22cca441eb56 | fd56601d907546ef6b0f2d4b374d22cca441eb56 |
+| 985-restore.ps1 | 96658345a6001e5c22b5e5b4174404edbff12127 | 96658345a6001e5c22b5e5b4174404edbff12127 |
+| 985-csharpier.ps1 | 4436583817876b8c12d968489805c1655f46ddfb | 4436583817876b8c12d968489805c1655f46ddfb |
+| 985-msbuild.ps1 | 7b80d637d6f7abccbf4df86877ac561fc0a0c6dc | 7b80d637d6f7abccbf4df86877ac561fc0a0c6dc |
+| 985-mstest.ps1 | f45cc585940fd1efe2c0b409573b5c815e2fe7d8 | f45cc585940fd1efe2c0b409573b5c815e2fe7d8 |
+| 985-pester.ps1 | 74ddc15e1a935c4b5dbd0efa4a72b63d9fcc0913 | 74ddc15e1a935c4b5dbd0efa4a72b63d9fcc0913 |
+| 985-junit.ps1 | 4df03fc0b964ac2d337c37141a5266f89b5c96a3 | 4df03fc0b964ac2d337c37141a5266f89b5c96a3 |
+| 985-repair.ps1 | 5cc7c5caaa7f90e37076de4ead07ce66332fe948 | 5cc7c5caaa7f90e37076de4ead07ce66332fe948 |
+| 985-nuget-update.ps1 | cb461c5cfd131c592f587cc6b583d468239280ea | cb461c5cfd131c592f587cc6b583d468239280ea |
+
+## Open item
+
+P7-T17 (rehearsal worktree and throwaway branch removal) is unchecked: the PreToolUse hook refused `git worktree remove` (EPIC_WORKTREE_REMOVAL_BLOCKED). The rehearsal worktree under the session scratchpad and the local branch rehearsal-985-throwaway remain; no remote branch exists.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/commit-fix.2026-10-09T14-34.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/commit-fix.2026-10-09T14-34.md
new file mode 100644
index 000000000..2256ccac2
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/commit-fix.2026-10-09T14-34.md
@@ -0,0 +1,13 @@
+# Fix Commit (P6-T1)
+
+Timestamp: 2026-10-09T14-34
+Command: C4 (Grep `(?i)[a-z]:[\\/]+users[\\/]+[a-z0-9_.~-]` count over FEATURE and over the .git pointer file); git add -- <nine Write Set paths> FEATURE <ten agent-memory paths>; git commit -m "fix(deps): declare borrowed test packages and sync transitive binding redirects (#985)" -m <body> -m <attribution trailers>; git rev-parse HEAD; git diff --name-only HEAD~1 HEAD; git status --porcelain
+EXIT_CODE: 0
+Output Summary:
+- C4: FEATURE count 0; positive control (.git pointer file) count 1.
+- FIX-SHA: c83b6a965d9283cb28a03d74fc8c2e40b4908de0
+- Commit: 64 files changed, 3446 insertions(+), 609 deletions(-)
+- Committed names: the nine Write Set paths (QuickFiler.Test/packages.config, UtilitiesCS.Test/packages.config, TaskTree.Test/packages.config, QuickFiler.Test/QuickFiler.Test.csproj, scripts/dependencies/BindingRedirectSync.psm1, scripts/dependencies/Repair-PackageManifestConsistency.ps1, tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1, tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1, tests/scripts/dependencies/BindingRedirectSync.Tests.ps1), 45 FEATURE paths and 10 .claude/agent-memory/ paths; nothing else.
+- Porcelain after commit: one line, `?? docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md`, which is in PreExistingWorktreePaths.
+- AGENT-MEMORY-LINES (staged): .claude/agent-memory/atomic-executor/MEMORY.md, .claude/agent-memory/atomic-planner/MEMORY.md, .claude/agent-memory/task-researcher/MEMORY.md, .claude/agent-memory/atomic-executor/index_overflow_entries.md, .claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md, .claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md, .claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md, .claude/agent-memory/task-researcher/index_epic136_percoverage_children.md, .claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md, .claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
+- Result: PASS; no push performed.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/integration-rehearsal.2026-10-09T14-35.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/integration-rehearsal.2026-10-09T14-35.md
new file mode 100644
index 000000000..0b7dee971
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/integration-rehearsal.2026-10-09T14-35.md
@@ -0,0 +1,344 @@
+# Integration Rehearsal (Phase 7, AC6)
+
+Timestamp: 2026-10-09T14-35
+Command: git fetch origin dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9
+EXIT_CODE: 0
+Output Summary:
+- DEPENDABOT-SHA: fff92fe83032d00dfa84225c960928a82a6843f2 (git rev-parse origin/dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9; the PR #984 repair commit)
+- Fetch exit 0.
+- Paths: the throwaway rehearsal worktree is written as REHEARSAL-ROOT (outside the repository, under the session scratchpad); this worktree is WORKSPACE-ROOT.
+
+## P7-T1 Fetch
+
+Command: git fetch origin dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9
+EXIT_CODE: 0
+
+```
+From https://github.com/drmoisan/TaskMaster
+ * branch                dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9 -> FETCH_HEAD
+DEPENDABOT-SHA: fff92fe83032d00dfa84225c960928a82a6843f2
+```
+
+## P7-T2 Rehearsal worktree
+
+Command: git worktree add -b rehearsal-985-throwaway REHEARSAL-ROOT origin/dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9; git -C REHEARSAL-ROOT rev-parse HEAD
+EXIT_CODE: 0
+
+```
+Preparing worktree (new branch 'rehearsal-985-throwaway')
+branch 'rehearsal-985-throwaway' set up to track 'origin/dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9'.
+HEAD is now at fff92fe83 chore(deps): repair manifest and project-file consistency
+REHEARSAL HEAD: fff92fe83032d00dfa84225c960928a82a6843f2 (equals DEPENDABOT-SHA)
+```
+
+## P7-T3 Merge (D2, -X ours)
+
+Command: git -C REHEARSAL-ROOT merge -X ours --no-edit bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985; git -C REHEARSAL-ROOT rev-parse HEAD; git -C REHEARSAL-ROOT status --porcelain; git -C REHEARSAL-ROOT merge-base --is-ancestor FIX-SHA HEAD
+EXIT_CODE: 0
+
+```
+Auto-merging QuickFiler.Test/QuickFiler.Test.csproj
+Auto-merging QuickFiler.Test/packages.config
+Auto-merging TaskTree.Test/packages.config
+Auto-merging UtilitiesCS.Test/packages.config
+Merge made by the 'ort' strategy.
+62 files changed, 3444 insertions(+), 604 deletions(-)
+(manifest lines of the stat: QuickFiler.Test/packages.config | 1 +; UtilitiesCS.Test/packages.config | 1 +; TaskTree.Test/packages.config and QuickFiler.Test/QuickFiler.Test.csproj absent from the stat, so -X ours dropped part of the fix there; P7-T4 verifies and re-applies)
+MERGE-SHA: 37a619f88b82b544c3ef0fa87dd318e917d0d2ad
+porcelain: (empty)
+merge-base --is-ancestor FIX-SHA HEAD: exit 0
+```
+
+## P7-T4 Fix content verification and re-application
+
+Command: git -C REHEARSAL-ROOT rev-parse HEAD:<path> versus git rev-parse FIX-SHA:<path> for the five PowerShell paths; Grep for the four declarations and the WebView2.Core Include in REHEARSAL-ROOT; Edit tool re-application
+EXIT_CODE: 0
+
+(a) Blob equality (REHEARSAL HEAD versus FIX-SHA), all five equal:
+
+```
+scripts/dependencies/BindingRedirectSync.psm1 ef8eee178ce3296a872281467320860f759ffd27 = ef8eee178ce3296a872281467320860f759ffd27
+scripts/dependencies/Repair-PackageManifestConsistency.ps1 eb9ff10ab693d4dc97f90d22149579838151f426 = eb9ff10ab693d4dc97f90d22149579838151f426
+tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 61b018e7270d5ca11d849a0300fe8514457c6533 = 61b018e7270d5ca11d849a0300fe8514457c6533
+tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 d82cfd5c6de703e82425c7be5cf2d078b071c990 = d82cfd5c6de703e82425c7be5cf2d078b071c990
+tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 d5b96cc3b46fda690e3b8b7edbaf60742664d88b = d5b96cc3b46fda690e3b8b7edbaf60742664d88b
+```
+
+(b) After the merge: QuickFiler.Test WebView2 present (line 42), UtilitiesCS.Test WebView2 present (line 64); QuickFiler.Test ObjectListView.Official absent; TaskTree.Test ObjectListView.Official absent; QuickFiler.Test.csproj `Include="Microsoft.Web.WebView2.Core,` count 2 (lines 390 and 531; the duplicate item group 530-534 survived the merge).
+
+```
+REAPPLIED: QuickFiler.Test/packages.config inserted `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` before the OpenTelemetry line (first id comparing greater), now line 47
+REAPPLIED: TaskTree.Test/packages.config inserted `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` before the OpenTelemetry line, now line 41
+REAPPLIED: QuickFiler.Test/QuickFiler.Test.csproj deleted the surviving duplicate WebView2.Core item group (five lines, formerly 530-534)
+```
+
+Afterwards: each of the four declarations count 1 (QuickFiler.Test WebView2 line 42, QuickFiler.Test ObjectListView line 47, UtilitiesCS.Test WebView2 line 64, TaskTree.Test ObjectListView line 41); WebView2.Core Include count 1 in QuickFiler.Test.csproj.
+
+Note: on the Dependabot branch the production siblings declare Microsoft.Web.WebView2 1.0.4258.31 (QuickFiler/packages.config line 19, UtilitiesCS/packages.config line 57) and ObjectListView.Official 2.9.1 (QuickFiler line 22, TaskTree line 8); P7-T7 decides the D1 simulation rows.
+
+## P7-T5 Restore (pre-simulation)
+
+Command: pwsh -NoProfile -File CMDDIR\985-restore.ps1 -WorkspaceRoot REHEARSAL-ROOT (nuget restore TaskMaster.sln -NonInteractive)
+EXIT_CODE: 0
+
+```
+LINE-COUNT: 587
+TAIL: Installed:
+TAIL:     174 package(s) to packages.config projects
+```
+
+## P7-T6 DIAGNOSTIC (literal merge, -WhatIf)
+
+Command: pwsh -NoProfile -File CMDDIR\985-repair.ps1 -WorkspaceRoot REHEARSAL-ROOT -WhatIfRun (& REHEARSAL-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1 -WhatIf)
+EXIT_CODE: 0
+
+```
+COMMAND: & WORKSPACE-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1 -WhatIf
+Manifest discovery: enumerated directories 34, returned files 53 (printed 4 times before the sync and 2 times after)
+What if: Performing the operation "Synchronise binding redirects" on target "REHEARSAL-ROOT\Tags.Test\app.config".
+What if: Performing the operation "Synchronise binding redirects" on target "REHEARSAL-ROOT\TaskTree.Test\app.config".
+What if: Performing the operation "Synchronise binding redirects" on target "REHEARSAL-ROOT\TaskVisualization.Test\app.config".
+What if: Performing the operation "Synchronise binding redirects" on target "REHEARSAL-ROOT\ToDoModel.Test\app.config".
+What if: Performing the operation "Synchronise binding redirects" on target "REHEARSAL-ROOT\VBFunctions.Test\app.config".
+Binding redirect sync: examined 17 application configuration file(s), synchronised 5 redirect(s), unverifiable 1, unresolvable 0
+IS-SUCCESS: True
+WRITTEN-COUNT: 0
+REPAIR-COUNT: 0
+BEYOND-KNOWN-WEAK: 0
+REPORT-REPAIR-KINDS:
+SKIP-COUNT: 0
+REDIRECTSYNC-REPAIR-COUNT: 5
+REDIRECTSYNC: Tags.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: TaskTree.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: TaskVisualization.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: ToDoModel.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: VBFunctions.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC-UNVERIFIABLE: netstandard
+REDIRECTSYNC-UNRESOLVABLE:
+BODY-BEGIN
+## Repairs applied
+No repairs were applied.
+
+## Binding redirects synchronised
+- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- TaskTree.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- TaskVisualization.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- ToDoModel.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- VBFunctions.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+BODY-END
+```
+
+The script completed; WRITTEN-COUNT 0 under -WhatIf; the five transitive log4net redirects research section 4.2 predicted are the five proposed syncs.
+
+## P7-T7 D1 simulation rows
+
+Command: Grep `id="(Microsoft\.Web\.WebView2|ObjectListView\.Official)"` over REHEARSAL-ROOT production and test manifests
+EXIT_CODE: 0
+
+Production values: QuickFiler/packages.config line 19 Microsoft.Web.WebView2 1.0.4258.31; UtilitiesCS/packages.config line 57 Microsoft.Web.WebView2 1.0.4258.31 (the two WebView2 values agree); QuickFiler/packages.config line 22 ObjectListView.Official 2.9.1; TaskTree/packages.config line 8 ObjectListView.Official 2.9.1 (the two ObjectListView values agree).
+
+```
+SIM-ROW: QuickFiler.Test Microsoft.Web.WebView2 1.0.4191.47 1.0.4258.31 UPDATE
+SIM-ROW: UtilitiesCS.Test Microsoft.Web.WebView2 1.0.4191.47 1.0.4258.31 UPDATE
+SIM-ROW: QuickFiler.Test ObjectListView.Official 2.9.1 2.9.1 NONE
+SIM-ROW: TaskTree.Test ObjectListView.Official 2.9.1 2.9.1 NONE
+```
+
+## P7-T8 Simulated Dependabot update (D1)
+
+Command: pwsh -NoProfile -File CMDDIR\985-nuget-update.ps1 -WorkspaceRoot REHEARSAL-ROOT -ProjectDirectory <test project> -PackageId Microsoft.Web.WebView2 -PackageVersion 1.0.4258.31 (for QuickFiler.Test, then UtilitiesCS.Test); git -C REHEARSAL-ROOT diff --stat; git -C REHEARSAL-ROOT status --porcelain
+EXIT_CODE: 0
+
+```
+COMMAND: nuget update QuickFiler.Test\packages.config -Id Microsoft.Web.WebView2 -Version 1.0.4258.31 -RepositoryPath WORKSPACE-ROOT\packages -NonInteractive -FileConflictAction Ignore
+EXIT_CODE: 0
+TAIL: Removed package 'Microsoft.Web.WebView2 1.0.4191.47' from 'packages.config'
+TAIL: Successfully uninstalled 'Microsoft.Web.WebView2 1.0.4191.47' from QuickFiler.Test
+TAIL: Added package 'Microsoft.Web.WebView2.1.0.4258.31' to 'packages.config'
+TAIL: Successfully installed 'Microsoft.Web.WebView2 1.0.4258.31' to QuickFiler.Test
+COMMAND: nuget update UtilitiesCS.Test\packages.config -Id Microsoft.Web.WebView2 -Version 1.0.4258.31 -RepositoryPath WORKSPACE-ROOT\packages -NonInteractive -FileConflictAction Ignore
+EXIT_CODE: 0
+TAIL: Removed package 'Microsoft.Web.WebView2 1.0.4191.47' from 'packages.config'
+TAIL: Successfully uninstalled 'Microsoft.Web.WebView2 1.0.4191.47' from UtilitiesCS.Test
+TAIL: Added package 'Microsoft.Web.WebView2.1.0.4258.31' to 'packages.config'
+TAIL: Successfully installed 'Microsoft.Web.WebView2 1.0.4258.31' to UtilitiesCS.Test
+diff --stat:
+ QuickFiler.Test/QuickFiler.Test.csproj   | 21 ++++++++++++---------
+ QuickFiler.Test/packages.config          |  7 ++++---
+ TaskTree.Test/packages.config            |  1 +
+ UtilitiesCS.Test/UtilitiesCS.Test.csproj | 20 ++++++++++++++------
+ UtilitiesCS.Test/packages.config         |  6 +++---
+ 5 files changed, 34 insertions(+), 21 deletions(-)
+porcelain:
+ M QuickFiler.Test/QuickFiler.Test.csproj
+ M QuickFiler.Test/packages.config
+ M TaskTree.Test/packages.config
+ M UtilitiesCS.Test/UtilitiesCS.Test.csproj
+ M UtilitiesCS.Test/packages.config
+```
+
+Afterwards: QuickFiler.Test/packages.config line 42 and UtilitiesCS.Test/packages.config line 64 declare Microsoft.Web.WebView2 1.0.4258.31; Grep `Microsoft\.Web\.WebView2\.1\.0\.4191\.47` over the two updated test csproj files returns 0 (positive control: `Microsoft\.Web\.WebView2\.1\.0\.4258\.31` returns 5 in each). The diff stat includes the P7-T4 re-applications (TaskTree.Test/packages.config and the QuickFiler.Test csproj group removal).
+
+## P7-T9 Workflow step "Restore solution" (dependabot-repair.yml line 74)
+
+Command: pwsh -NoProfile -File CMDDIR\985-restore.ps1 -WorkspaceRoot REHEARSAL-ROOT (nuget restore TaskMaster.sln -NonInteractive)
+EXIT_CODE: 0
+
+```
+LINE-COUNT: 8
+TAIL:   OK https://api.nuget.org/v3-vulnerabilities/2026.10.06.23.47.38/2026.10.09.05.47.56/vulnerability.update.json 48ms
+```
+
+## P7-T10 Workflow step "Repair package manifest consistency" (dependabot-repair.yml line 80, no arguments)
+
+Command: pwsh -NoProfile -File CMDDIR\985-repair.ps1 -WorkspaceRoot REHEARSAL-ROOT (& REHEARSAL-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1)
+EXIT_CODE: 0
+
+```
+COMMAND: & WORKSPACE-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1
+Manifest discovery: enumerated directories 34, returned files 53 (printed 4 times before the sync and 2 times after)
+Binding redirect sync: examined 17 application configuration file(s), synchronised 7 redirect(s), unverifiable 1, unresolvable 0
+IS-SUCCESS: True
+WRITTEN-COUNT: 9
+WRITTEN: QuickFiler.Test\app.config
+WRITTEN: Tags.Test\app.config
+WRITTEN: TaskTree.Test\app.config
+WRITTEN: TaskVisualization.Test\app.config
+WRITTEN: ToDoModel.Test\app.config
+WRITTEN: UtilitiesCS.Test\app.config
+WRITTEN: VBFunctions.Test\app.config
+WRITTEN: QuickFiler.Test\packages.config
+WRITTEN: UtilitiesCS.Test\packages.config
+REPAIR-COUNT: 0
+BEYOND-KNOWN-WEAK: 0
+REPORT-REPAIR-KINDS:
+SKIP-COUNT: 0
+REDIRECTSYNC-REPAIR-COUNT: 7
+REDIRECTSYNC: QuickFiler.Test Microsoft.Web.WebView2.Core 1.0.4191.47 to 1.0.4258.31 OwnReference
+REDIRECTSYNC: Tags.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: TaskTree.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: TaskVisualization.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: ToDoModel.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC: UtilitiesCS.Test Microsoft.Web.WebView2.Core 1.0.4191.47 to 1.0.4258.31 OwnReference
+REDIRECTSYNC: VBFunctions.Test log4net 3.4.0.0 to 3.5.0.0 HighestDeployed
+REDIRECTSYNC-UNVERIFIABLE: netstandard
+REDIRECTSYNC-UNRESOLVABLE:
+BODY-BEGIN
+## Repairs applied
+No repairs were applied.
+
+## Binding redirects synchronised
+- QuickFiler.Test: Microsoft.Web.WebView2.Core 1.0.4191.47 to 1.0.4258.31 (OwnReference)
+- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- TaskTree.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- TaskVisualization.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- ToDoModel.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+- UtilitiesCS.Test: Microsoft.Web.WebView2.Core 1.0.4191.47 to 1.0.4258.31 (OwnReference)
+- VBFunctions.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)
+BODY-END
+```
+
+The sync rewrote the five transitive log4net redirects and the two test-project WebView2.Core redirects the packages.config updater leaves untouched; the normalisation pass reflowed the two manifests the simulated update wrote.
+
+## P7-T11 Idempotence (post-push re-fire)
+
+Command: pwsh -NoProfile -File CMDDIR\985-repair.ps1 -WorkspaceRoot REHEARSAL-ROOT (second run, no arguments)
+EXIT_CODE: 0
+
+```
+Binding redirect sync: examined 17 application configuration file(s), synchronised 0 redirect(s), unverifiable 1, unresolvable 0
+IS-SUCCESS: True
+WRITTEN-COUNT: 0
+REPAIR-COUNT: 0
+BEYOND-KNOWN-WEAK: 0
+REPORT-REPAIR-KINDS:
+SKIP-COUNT: 0
+REDIRECTSYNC-REPAIR-COUNT: 0
+REDIRECTSYNC-UNVERIFIABLE: netstandard
+REDIRECTSYNC-UNRESOLVABLE:
+BODY-BEGIN
+## Repairs applied
+No repairs were applied.
+BODY-END
+```
+
+## P7-T12 Restore after the repair writes
+
+Command: pwsh -NoProfile -File CMDDIR\985-restore.ps1 -WorkspaceRoot REHEARSAL-ROOT (nuget restore TaskMaster.sln -NonInteractive)
+EXIT_CODE: 0
+
+```
+LINE-COUNT: 5
+TAIL: All packages listed in packages.config are already installed.
+```
+
+## P7-T13 Analyzer build of REHEARSAL-ROOT\TaskMaster.sln
+
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot REHEARSAL-ROOT -Gate Analyzers -LogName 985-rehearsal-analyzers.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true)
+EXIT_CODE: 0
+
+```
+EXIT_CODE: 0
+OUTPUT-ASSEMBLIES: 18
+SUMMARY: 0 Warning(s)
+SUMMARY: 0 Error(s)
+ERROR-LINE-COUNT: 0
+PATH-LENGTH-SIGNATURE-LINES: 0
+```
+
+## P7-T14 Nullable build of REHEARSAL-ROOT\TaskMaster.sln
+
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot REHEARSAL-ROOT -Gate Nullable -LogName 985-rehearsal-nullable.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true)
+EXIT_CODE: 0
+
+```
+EXIT_CODE: 0
+OUTPUT-ASSEMBLIES: 18
+SUMMARY: 0 Warning(s)
+SUMMARY: 0 Error(s)
+ERROR-LINE-COUNT: 0
+PATH-LENGTH-SIGNATURE-LINES: 0
+```
+
+## P7-T15 Pester in REHEARSAL-ROOT
+
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot REHEARSAL-ROOT -TestPath tests/scripts/dependencies/BindingRedirectVerification.Tests.ps1,tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
+EXIT_CODE: 0
+
+```
+TEST-PATH-COUNT: 2
+COVERAGE-PATH-COUNT: 0
+PESTER-VERSION: 5.6.1
+PESTER Passed=21 Failed=0 Skipped=0 NotRun=0 Total=21
+FILE-TESTS BindingRedirectVerification.Tests.ps1 Passed=16 Failed=0 Total=16
+FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=5 Failed=0 Total=5
+```
+
+The BindingRedirectVerification repository invariant (the assertion that failed on CI run #1059 with `log4net|3.4.0.0`) passes on the repaired rehearsal tree, and the new orphaned-HintPath gate passes there too.
+
+## P7-T16 Verdict
+
+REHEARSAL-VERDICT: PASS
+
+- P7-T10 repair (workflow-faithful, no arguments): EXIT_CODE 0, IS-SUCCESS True, WRITTEN-COUNT 9, 7 synchronised redirects (5 transitive log4net, 2 test WebView2.Core), BEYOND-KNOWN-WEAK 0.
+- P7-T11 idempotent re-fire: EXIT_CODE 0, IS-SUCCESS True, WRITTEN-COUNT 0, REDIRECTSYNC-REPAIR-COUNT 0.
+- P7-T13 analyzer Rebuild: EXIT_CODE 0, 18 output assemblies, 0 Error(s), ERROR-LINE-COUNT 0.
+- P7-T14 nullable Rebuild (/p:TreatWarningsAsErrors=true): EXIT_CODE 0, 18 output assemblies, 0 Error(s), ERROR-LINE-COUNT 0.
+- P7-T15 Pester: BindingRedirectVerification.Tests.ps1 16/16 and RepositoryTreeConsistency.Tests.ps1 5/5 passed.
+- Fidelity note (plan D1): the two test-project WebView2 declarations were bumped to 1.0.4258.31 by a simulated packages.config update (P7-T8) to model the post-merge `@dependabot recreate`; binding redirects were left to the repair script's sync pass.
+- C4 sanitize after the verdict: FEATURE count 0; positive control (.git pointer file) count 1.
+
+## P7-T17 Cleanup (BLOCKED, not completed)
+
+Command: git worktree remove --force REHEARSAL-ROOT; git branch -D rehearsal-985-throwaway
+EXIT_CODE: 1
+
+```
+CLEANUP: git worktree remove refused by the PreToolUse hook before execution: EPIC_WORKTREE_REMOVAL_BLOCKED: TARGET_WORKTREE_NOT_DERIVABLE: no live worktree's run checkpoint records worktree_path 'REHEARSAL-ROOT' in the epic checkpoint; removal requires an epic or parallel-orchestrator checkpoint record with merge_status in {merged, worktree_removed}.
+CLEANUP: git branch -D rehearsal-985-throwaway not run (same command; the branch is still checked out in the rehearsal worktree).
+CLEANUP: git worktree list --porcelain still lists REHEARSAL-ROOT (HEAD 37a619f88b82b544c3ef0fa87dd318e917d0d2ad, branch refs/heads/rehearsal-985-throwaway).
+CLEANUP: git branch --list rehearsal-985-throwaway: "+ rehearsal-985-throwaway" (present, checked out in the rehearsal worktree).
+CLEANUP: git ls-remote --heads origin rehearsal-985-throwaway: empty (exit 0); the branch was never pushed.
+```
+
+The hook was not bypassed. Removing the rehearsal worktree and branch needs either the user's explicit approval to route around the hook or a checkpoint record that authorizes the removal. The rehearsal content is not in the repository; the worktree sits under the session scratchpad.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-post-impl.2026-10-09T14-20.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-post-impl.2026-10-09T14-20.md
new file mode 100644
index 000000000..26580a971
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-post-impl.2026-10-09T14-20.md
@@ -0,0 +1,27 @@
+# Post-implementation Line Counts (P3-T3)
+
+Timestamp: 2026-10-09T14-20
+Command: Grep tool, pattern `^`, output mode count, over scripts/dependencies/BindingRedirectSync.psm1 and scripts/dependencies/Repair-PackageManifestConsistency.ps1
+EXIT_CODE: 0
+Output Summary:
+- scripts/dependencies/BindingRedirectSync.psm1: 307 lines (at most 500)
+- scripts/dependencies/Repair-PackageManifestConsistency.ps1: 493 lines (at most 500; above the 475 baseline)
+- Result: both within the 500-line limit; no SIZE-LIMIT.
+
+## P3-T1 static checks (BindingRedirectSync.psm1)
+
+- `^Export-ModuleMember` count 1 (line 303)
+- `function` lines: Invoke-BindingRedirectSync (75), Invoke-SolutionBindingRedirectSync (170), Format-BindingRedirectSyncReport (276), one each
+- `Import-Module .*-Force` count 0
+- `[^\x00-\x7F]` count 0
+
+## P3-T2 static checks (Repair-PackageManifestConsistency.ps1)
+
+- `BindingRedirectSync\.psm1` 1 (line 73)
+- `Invoke-SolutionBindingRedirectSync` 1 (line 449)
+- `-WhatIf:\$WhatIfPreference` 2 (lines 450 and 456)
+- `RedirectSync\s+=` 1 (line 487)
+- `Format-BindingRedirectSyncReport` 1 (line 464)
+- `\$projectTextOverride\[` 1 (line 421)
+- The new call sits after the manifest loop and before normalisation, with no `-CandidateUpgrade` condition.
+- Carriage-return count equals line count (493), so CRLF line endings are preserved.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-r1.2026-10-09T15-23.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-r1.2026-10-09T15-23.md
new file mode 100644
index 000000000..35de15047
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/line-counts-r1.2026-10-09T15-23.md
@@ -0,0 +1,32 @@
+# Production Line Counts and Implementation Counts (R1, issue #985)
+
+Timestamp: 2026-10-09T15-23
+Command: Grep tool counts (`^`, `\r$`, and the P3-T1 / P3-T2 tokens) over scripts/dependencies/BindingRedirectSync.psm1 and scripts/dependencies/Repair-PackageManifestConsistency.ps1
+EXIT_CODE: 0
+Output Summary:
+- `scripts/dependencies/BindingRedirectSync.psm1`: 328 lines (limit 500), 0 carriage returns (LF kept).
+- `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: 495 lines (limit 500; expected 495), 495 carriage returns (CRLF kept).
+- No SIZE-LIMIT condition.
+
+P3-T1 counts (`BindingRedirectSync.psm1`):
+| Pattern | Expected | Observed |
+|---|---|---|
+| `function Get-RedirectDirection` | 1 | 1 (line 76) |
+| `HashSet\[string\]\]::new\(\[System\.StringComparer\]::OrdinalIgnoreCase\)` | 1 | 1 (line 135) |
+| `\$handled\.Contains\(` | 0 | 0 |
+| `if \(-not \$handled\.Add\(` | 1 | 1 (line 142) |
+| `Direction\s+= \(Get-RedirectDirection` | 1 | 1 (line 175) |
+| `\(\{4\}, \{5\}\)` | 1 | 1 (line 318) |
+| `'Get-RedirectDirection'` (not exported) | 0 | 0 |
+| `^Export-ModuleMember` | 1 | 1 (line 324) |
+| `[^\x00-\x7F]` | 0 | 0 |
+
+P3-T2 counts (`Repair-PackageManifestConsistency.ps1`):
+| Pattern | Expected | Observed |
+|---|---|---|
+| `distinctWritten` | 2 | 2 (lines 467, 476) |
+| `OrdinalIgnoreCase` on the `$distinctWritten =` line | at least 1 | 1 (line 467, read: `[System.StringComparer]::OrdinalIgnoreCase`) |
+| `\$written\.ToArray\(\)` | 0 | 0 |
+| `\r$` equal to line count | 495 | 495 |
+
+Note: a two-line reflow of the `.DESCRIPTION` paragraph of `Invoke-BindingRedirectSync` was made after the item-6 wording change, so the paragraph wraps at the file's existing width; the counts above were taken after that reflow.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/manifest-edit-facts.2026-10-09T14-17.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/manifest-edit-facts.2026-10-09T14-17.md
new file mode 100644
index 000000000..08b4b8385
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/manifest-edit-facts.2026-10-09T14-17.md
@@ -0,0 +1,50 @@
+# Manifest Edit Facts (P2-T6)
+
+Timestamp: 2026-10-09T14-17
+Command: Grep tool counts (`^`, `\r$`, declaration patterns); git diff --numstat BASE-SHA -- QuickFiler.Test/packages.config UtilitiesCS.Test/packages.config TaskTree.Test/packages.config QuickFiler.Test/QuickFiler.Test.csproj; git status --porcelain -- (same four paths)
+EXIT_CODE: 0
+Output Summary:
+- Line counts: QuickFiler.Test 76, UtilitiesCS.Test 111, TaskTree.Test 70 (expected 76, 111, 70)
+- Carriage-return counts: QuickFiler.Test 75, UtilitiesCS.Test 110, TaskTree.Test 69 (expected 75, 110, 69; every inserted line kept CRLF)
+- numstat: QuickFiler.Test/packages.config 2 0; UtilitiesCS.Test/packages.config 1 0; TaskTree.Test/packages.config 1 0; QuickFiler.Test/QuickFiler.Test.csproj 0 5 (expected 2 0, 1 0, 1 0, 0 5)
+- porcelain: ` M` for all four paths
+- QuickFiler.Test.csproj: `Include="Microsoft.Web.WebView2.Core,` count 1 (line 388); 567 lines; `Microsoft.Web.WebView2.1.0.4191.47` folder count 2 (lines 389, 392)
+- Result: every value equals the expectation.
+
+## Inserted lines
+
+| File | Line | Text |
+|---|---|---|
+| QuickFiler.Test/packages.config | 42 | `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` |
+| QuickFiler.Test/packages.config | 47 | `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` |
+| UtilitiesCS.Test/packages.config | 64 | `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` |
+| TaskTree.Test/packages.config | 41 | `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` |
+
+## Production sibling declarations (re-read in this task)
+
+| Sibling | Line | Text |
+|---|---|---|
+| QuickFiler/packages.config | 19 | `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` |
+| QuickFiler/packages.config | 22 | `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` |
+| UtilitiesCS/packages.config | 57 | `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` |
+| TaskTree/packages.config | 8 | `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` |
+
+Each inserted declaration matches its production sibling's id, version and targetFramework, and the folder the existing HintPaths name (`Microsoft.Web.WebView2.1.0.4191.47`, `ObjectListView.Official.2.9.1`).
+
+## numstat
+
+```
+0	5	QuickFiler.Test/QuickFiler.Test.csproj
+2	0	QuickFiler.Test/packages.config
+1	0	TaskTree.Test/packages.config
+1	0	UtilitiesCS.Test/packages.config
+```
+
+## porcelain
+
+```
+ M QuickFiler.Test/QuickFiler.Test.csproj
+ M QuickFiler.Test/packages.config
+ M TaskTree.Test/packages.config
+ M UtilitiesCS.Test/packages.config
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/remediation-r1-summary.2026-10-09T15-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/remediation-r1-summary.2026-10-09T15-30.md
new file mode 100644
index 000000000..bbcaa3b5e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/remediation-r1-summary.2026-10-09T15-30.md
@@ -0,0 +1,21 @@
+# Remediation R1 Summary (review 2026-10-09T14-55, issue #985)
+
+Timestamp: 2026-10-09T15-30
+Command: Grep tool `^- \[[ x]\] AC` over FEATURE/spec.md (content, -o); artifact paths cross-checked against the evidence tree
+EXIT_CODE: 0
+Output Summary:
+- Six remediation items mapped below, each to existing artifacts.
+- spec.md AC state: AC1 to AC6 `[x]` (lines 193-198), AC7 `[ ]` (line 199); unchanged from the start of the cycle. No AC checkbox or AC text changed in R1.
+- AC7 remains pending CI (post-merge `@dependabot recreate` on PR #984), checked off by the item's orchestrator run after CI is observed.
+- D1 residual: the workflow comment drift in `.github/workflows/dependabot-repair.yml` lines 87-105 stays out of scope (AC4) and is promoted to issue #986 (promoted record `docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md`, committed without content change).
+
+| Item | Fail-before | Pass-after | QA-gate artifacts |
+|---|---|---|---|
+| B-1 (account name in committed plan) | `evidence/regression-testing/fail-before-identity-sweep.2026-10-09T15-20.md` | `evidence/regression-testing/pass-after-identity-sweep.2026-10-09T15-20.md` | `evidence/qa-gates/identity-sweep-final-r1.<TS>.md` (P6-T2) |
+| CR-1 (Direction on repair records and report lines) | `evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md`, `evidence/regression-testing/fail-before-repair-written-path.2026-10-09T15-22.md` (N7) | `evidence/regression-testing/pass-after-sync-module.2026-10-09T15-23.md`, `evidence/regression-testing/pass-after-repair-written-path.2026-10-09T15-23.md` | `evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md` |
+| CR-2 (WrittenPath lists each path once) | `evidence/regression-testing/fail-before-repair-written-path.2026-10-09T15-22.md` (N9) | `evidence/regression-testing/pass-after-repair-written-path.2026-10-09T15-23.md` | `evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md`, `evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md` |
+| CR-3 (case-insensitive handled-name check) | `evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md` (N5) | `evidence/regression-testing/pass-after-sync-module.2026-10-09T15-23.md` | `evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md` |
+| AC4-RECHECK (no workflow change) | not applicable (scope guard) | `evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md` | `evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md` |
+| AC5-RECHECK (in-memory tests, coverage, toolchain) | not applicable | `evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md` | `evidence/qa-gates/ps-format-r1.2026-10-09T15-26.md`, `evidence/qa-gates/ps-analyze-r1.2026-10-09T15-26.md`, `evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md`, `evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md`, `evidence/qa-gates/ps-line-counts-r1.2026-10-09T15-29.md`, `evidence/qa-gates/coverage-comparison-powershell-r1.2026-10-09T15-29.md`, `evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md` |
+
+Coverage headline (PowerShell, direct Pester): aggregate 94.98 to 94.99; `BindingRedirectSync.psm1` 100.00 to 100.00; `Repair-PackageManifestConsistency.ps1` 94.14 to 94.17.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md
new file mode 100644
index 000000000..73399cdd8
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md
@@ -0,0 +1,31 @@
+# Live-tree WhatIf Smoke (R1, issue #985)
+
+Timestamp: 2026-10-09T15-26
+Command: git status --porcelain; pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-repair.ps1 -WorkspaceRoot WORKSPACE-ROOT -WhatIfRun; git status --porcelain
+EXIT_CODE: 0
+Output Summary:
+- Script completed; IS-SUCCESS: True (recorded, not gated).
+- WRITTEN-COUNT: 0
+- REDIRECTSYNC-REPAIR-COUNT: 0
+- REDIRECTSYNC-UNVERIFIABLE: netstandard (the known case)
+- REDIRECTSYNC-UNRESOLVABLE: (empty)
+- git status --porcelain before and after: identical (26 lines each).
+- Information line: "Binding redirect sync: examined 17 application configuration file(s), synchronised 0 redirect(s), unverifiable 1, unresolvable 0"
+
+Helper output (the per-file `What if:` lines are omitted; all other lines verbatim):
+```
+COMMAND: & WORKSPACE-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1 -WhatIf
+IS-SUCCESS: True
+WRITTEN-COUNT: 0
+REPAIR-COUNT: 0
+BEYOND-KNOWN-WEAK: 0
+REPORT-REPAIR-KINDS: 
+SKIP-COUNT: 0
+REDIRECTSYNC-REPAIR-COUNT: 0
+REDIRECTSYNC-UNVERIFIABLE: netstandard
+REDIRECTSYNC-UNRESOLVABLE: 
+BODY-BEGIN
+## Repairs applied
+No repairs were applied.
+BODY-END
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree.2026-10-09T14-21.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree.2026-10-09T14-21.md
new file mode 100644
index 000000000..8ea3d9791
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/other/whatif-live-tree.2026-10-09T14-21.md
@@ -0,0 +1,49 @@
+# Live-tree WhatIf Repair Run (P3-T6)
+
+Timestamp: 2026-10-09T14-21
+Command: pwsh -NoProfile -File CMDDIR\985-repair.ps1 -WorkspaceRoot WORKSPACE-ROOT -WhatIfRun (runs & WORKSPACE-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1 -WhatIf); git status --porcelain immediately before and after
+EXIT_CODE: 0
+Output Summary:
+- IS-SUCCESS: True (recorded, not gated)
+- WRITTEN-COUNT: 0
+- REPAIR-COUNT: 0; BEYOND-KNOWN-WEAK: 0; REPORT-REPAIR-KINDS: (empty); SKIP-COUNT: 0
+- REDIRECTSYNC-REPAIR-COUNT: 0 (the working tree's redirects already satisfy the BindingRedirectVerification invariant)
+- REDIRECTSYNC-UNVERIFIABLE: netstandard
+- REDIRECTSYNC-UNRESOLVABLE: (empty)
+- Sync information line: Binding redirect sync: examined 17 application configuration file(s), synchronised 0 redirect(s), unverifiable 1, unresolvable 0
+- Porcelain before and after the run: identical (21 lines each; listed below).
+- Observation (not gated, pre-existing behaviour of the normalisation pass): the run printed 17 `What if: Performing the operation "Rewrite in canonical inline form"` lines for packages.config files (QuickFiler.Test, QuickFiler, SVGControl.Test, Tags.Test, Tags, TaskMaster.Test, TaskMaster, TaskTree.Test, TaskTree, TaskVisualization.Test, TaskVisualization, ToDoModel.Test, ToDoModel, UtilitiesCS.Test, UtilitiesCS, VBFunctions.Test, VBFunctions); -WhatIf suppressed every write.
+- Result: no STOP: LIVE-TREE-SYNC-NONZERO.
+
+## Body
+
+```
+## Repairs applied
+No repairs were applied.
+```
+
+## Porcelain (before and after, identical)
+
+```
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/task-researcher/MEMORY.md
+ M QuickFiler.Test/QuickFiler.Test.csproj
+ M QuickFiler.Test/packages.config
+ M TaskTree.Test/packages.config
+ M UtilitiesCS.Test/packages.config
+ M scripts/dependencies/Repair-PackageManifestConsistency.ps1
+ M tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
+?? .claude/agent-memory/atomic-executor/index_overflow_entries.md
+?? .claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md
+?? .claude/agent-memory/atomic-planner/index_preflight_seams_900_to_973.md
+?? .claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md
+?? .claude/agent-memory/task-researcher/index_epic136_percoverage_children.md
+?? .claude/agent-memory/task-researcher/index_quickfiler_efc_defects.md
+?? .claude/agent-memory/task-researcher/project_dependabot_repair_workflow_run_script_source_985.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/
+?? docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md
+?? scripts/dependencies/BindingRedirectSync.psm1
+?? tests/scripts/dependencies/BindingRedirectSync.Tests.ps1
+?? tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md
new file mode 100644
index 000000000..757ad8c9e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md
@@ -0,0 +1,13 @@
+# C# Coverage Comparison (P5-T6)
+
+Timestamp: 2026-10-09T14-31
+Command: comparison of FEATURE/evidence/baseline/cs-test.2026-10-09T14-11.md (P0-T13) and FEATURE/evidence/qa-gates/cs-test.2026-10-09T14-31.md (P5-T5); git diff --numstat BASE-SHA -- '*.cs'; git status --porcelain -- '*.cs'
+EXIT_CODE: 0
+Output Summary:
+- Baseline line coverage: 85.41 (56496/66143); final line coverage: 85.41 (56495/66143); delta 0.00 percentage points (one covered line fewer, within run-to-run variation; no C# source changed)
+- Baseline branch coverage: 79.83 (13709/17173); final branch coverage: 79.83 (13709/17173); delta 0.00
+- Runner floors (line 80, branch 75) met on both runs.
+- `git diff --numstat BASE-SHA -- '*.cs'`: empty
+- `git status --porcelain -- '*.cs'`: empty
+- New or changed C# code coverage: not applicable (no C# source line changed, proved by the two empty outputs above).
+- Result: PASS; no scope violation.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell-r1.2026-10-09T15-29.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell-r1.2026-10-09T15-29.md
new file mode 100644
index 000000000..387f9cd05
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell-r1.2026-10-09T15-29.md
@@ -0,0 +1,10 @@
+# PowerShell Coverage Comparison (R1, issue #985)
+
+Timestamp: 2026-10-09T15-29
+Command: derived from `remediation-baseline/ps-coverage.2026-10-09T15-19.md` (P0-T8) and `qa-gates/ps-coverage-r1.2026-10-09T15-29.md` (P4-T4, ITERATION 1, the passing iteration)
+EXIT_CODE: 0
+Output Summary:
+- Aggregate line coverage (scripts/dependencies, scripts/hygiene, scripts/vscode): baseline 94.98 (1891/1991), final 94.99 (1898/1998), delta +0.01. Gate 80.00: PASS. POLICY-85-OBSERVATION: MET.
+- `BindingRedirectSync.psm1` (new code): baseline 100.00 (114/114), final 100.00 (120/120). Gate 90.00: PASS.
+- `Repair-PackageManifestConsistency.ps1` (changed lines, no regression): baseline 94.14 (225/239), final 94.17 (226/240). Gate not below 94.14: PASS.
+- PowerShell branch coverage: not measured by Pester; no branch gate applies.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md
new file mode 100644
index 000000000..3d661acf2
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md
@@ -0,0 +1,14 @@
+# PowerShell Coverage Comparison (P4-T7)
+
+Timestamp: 2026-10-09T14-26
+Command: comparison of FEATURE/evidence/baseline/ps-coverage.2026-10-09T14-04.md (P0-T8) and FEATURE/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md (P4-T4, iteration 2)
+EXIT_CODE: 0
+Output Summary:
+- Baseline aggregate line coverage (scripts/dependencies, scripts/hygiene, scripts/vscode): 94.64 (1765/1865)
+- Final aggregate line coverage: 94.98 (1891/1991)
+- Delta: +0.34 percentage points (gate: final at or above 80.00; PASS)
+- BindingRedirectSync.psm1 (new code) final line coverage: 100.00 (114/114) (gate: at or above 90.00; PASS)
+- Repair-PackageManifestConsistency.ps1 (changed file) baseline 93.83 (213/227), final 94.14 (225/239) (gate: final not lower than baseline; PASS)
+- POLICY-85-OBSERVATION: MET (94.98)
+- PowerShell branch coverage: not measured by Pester; no branch gate applies (.claude/rules/powershell.md).
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md
new file mode 100644
index 000000000..240ff1c00
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md
@@ -0,0 +1,14 @@
+# C# Analyzer Gate (P5-T3)
+
+Timestamp: 2026-10-09T14-30
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot WORKSPACE-ROOT -Gate Analyzers -LogName 985-final-analyzers.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true)
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- EXIT_CODE: 0
+- OUTPUT-ASSEMBLIES: 18 (equal to BASELINE-OUTPUT-ASSEMBLIES 18)
+- SUMMARY: 0 Warning(s)
+- SUMMARY: 0 Error(s)
+- ERROR-LINE-COUNT: 0
+- PATH-LENGTH-SIGNATURE-LINES: 0
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-format.2026-10-09T14-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-format.2026-10-09T14-30.md
new file mode 100644
index 000000000..086f2a2b5
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-format.2026-10-09T14-30.md
@@ -0,0 +1,11 @@
+# C# Format Gate (P5-T1)
+
+Timestamp: 2026-10-09T14-30
+Command: git status --porcelain; pwsh -NoProfile -File CMDDIR\985-csharpier.ps1 -WorkspaceRoot WORKSPACE-ROOT -Mode format (dotnet tool run csharpier format .); git status --porcelain; pwsh -NoProfile -File CMDDIR\985-csharpier.ps1 -WorkspaceRoot WORKSPACE-ROOT -Mode check (dotnet tool run csharpier check .)
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- format: EXIT_CODE 0; Formatted 1650 files in 4650ms.
+- Porcelain before and after format: identical (21 lines); `git diff --numstat BASE-SHA` for the Write Set unchanged (QuickFiler.Test.csproj 0 5; the three manifests 2 0, 1 0, 1 0).
+- check: EXIT_CODE 0; Checked 1650 files in 4582ms.
+- Result: PASS (no rewrite; no loop restart).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-nullable.2026-10-09T14-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-nullable.2026-10-09T14-30.md
new file mode 100644
index 000000000..dc925032d
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-nullable.2026-10-09T14-30.md
@@ -0,0 +1,14 @@
+# C# Type-check Gate (P5-T4)
+
+Timestamp: 2026-10-09T14-30
+Command: pwsh -NoProfile -File CMDDIR\985-msbuild.ps1 -WorkspaceRoot WORKSPACE-ROOT -Gate Nullable -LogName 985-final-nullable.log (msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true)
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- EXIT_CODE: 0
+- OUTPUT-ASSEMBLIES: 18 (equal to the baseline 18)
+- SUMMARY: 0 Warning(s)
+- SUMMARY: 0 Error(s)
+- ERROR-LINE-COUNT: 0
+- PATH-LENGTH-SIGNATURE-LINES: 0
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-restore.2026-10-09T14-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-restore.2026-10-09T14-30.md
new file mode 100644
index 000000000..73da22d3f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-restore.2026-10-09T14-30.md
@@ -0,0 +1,10 @@
+# C# Restore Gate (P5-T2)
+
+Timestamp: 2026-10-09T14-30
+Command: pwsh -NoProfile -File CMDDIR\985-restore.ps1 -WorkspaceRoot WORKSPACE-ROOT (nuget restore TaskMaster.sln -NonInteractive)
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- EXIT_CODE: 0; LINE-COUNT: 5
+- TAIL: All packages listed in packages.config are already installed. (the new declarations Microsoft.Web.WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1 resolve to folders the production siblings already restored)
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-test.2026-10-09T14-31.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-test.2026-10-09T14-31.md
new file mode 100644
index 000000000..80786b2f5
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/cs-test.2026-10-09T14-31.md
@@ -0,0 +1,20 @@
+# C# Test Gate with Coverage (P5-T5)
+
+Timestamp: 2026-10-09T14-31
+Command: pwsh -NoProfile -File CMDDIR\985-mstest.ps1 -WorkspaceRoot WORKSPACE-ROOT -EvidencePrefix WORKSPACE-ROOT\FEATURE\evidence\qa-gates\mstest-coverage-final.2026-10-09T14-31
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- SHELL-ICON-EXCLUSION: APPLIED ShellUtilities_Tests ShellUtilitiesStatic_Tests SysImageListHelperTests OSBrowser_Tests (route D3; CI runs the full set)
+- Discovered 9 test assemblies.
+- First-party coverage: lines 56495/66143 (85.41%), branches 13709/17173 (79.83%)
+- RUNNER_RESULT=COMPLETED (runner floors line 80 and branch 75 enforced inside the runner; C7 flaky rule did not apply)
+- TRX-SUMMARY: Test run outcome: Completed
+- TRX-SUMMARY: Total 7427, executed 7427, passed 7427, failed 0.
+- TRX-SUMMARY: Skipped 0, derived as total minus executed rather than reported by the test platform.
+- TRX-SUMMARY: Figures reported verbatim by the test platform: error 0, timeout 0, aborted 0, notExecuted 0, inconclusive 0.
+- TRX-SUMMARY: Failed tests: none
+- PROJECTION-COPIED; copies present: mstest-coverage-final.2026-10-09T14-31.summary.txt and mstest-coverage-final.2026-10-09T14-31.jacoco.xml (beside this file)
+- FINAL-CS-LINE: 85.41
+- FINAL-CS-BRANCH: 79.83
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md
new file mode 100644
index 000000000..ba57935aa
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md
@@ -0,0 +1,16 @@
+# C# Toolchain Not-applicable Proof (R1, issue #985)
+
+Timestamp: 2026-10-09T15-30
+Command: git diff --name-only de397b992868882530a447c662d21b3fbff123eb -- "*.cs" "*.csproj" "*.props" "*.targets" "*.sln" "*.config"; git status --porcelain -- "*.cs" "*.csproj" "*.props" "*.targets" "*.sln" "*.config"
+EXIT_CODE: 0
+Output Summary:
+- `git diff --name-only <R1-START-SHA>` over the C#-family patterns: (empty)
+- `git status --porcelain` over the same patterns: (empty)
+- CSHARP-TOOLCHAIN: NOT RE-RUN (no C#-family file changed in R1)
+- Cycle-0 C# QA artifacts (Glob `FEATURE/evidence/qa-gates/cs-*.md`), 5 found:
+  - `evidence/qa-gates/cs-format.2026-10-09T14-30.md`
+  - `evidence/qa-gates/cs-restore.2026-10-09T14-30.md`
+  - `evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md`
+  - `evidence/qa-gates/cs-nullable.2026-10-09T14-30.md`
+  - `evidence/qa-gates/cs-test.2026-10-09T14-31.md`
+- Result: PASS; no SCOPE-VIOLATION.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/identity-sweep-final-r1.2026-10-09T15-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/identity-sweep-final-r1.2026-10-09T15-30.md
new file mode 100644
index 000000000..4e2a6c40f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/identity-sweep-final-r1.2026-10-09T15-30.md
@@ -0,0 +1,25 @@
+# Final Pre-commit Identity Sweep (R1, B-1, issue #985)
+
+Timestamp: 2026-10-09T15-30
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985r1-identity-sweep.ps1 -WorkspaceRoot WORKSPACE-ROOT -Base 9911fe138952e2b93476850582847c2831e1cbbd -Mode WorkingTree
+EXIT_CODE: 0
+Output Summary:
+- HITS-TOTAL: 0; every HITS- line 0; CONTROL-SYNTHETIC all =1; CONTROL-GITFILE-ACCOUNT: 1.
+- Scope: every added line of `git diff <BASE-SHA>` (committed branch changes plus uncommitted edits) and every line of the 34 untracked, non-ignored files (this cycle's plan, the review documents, all R1 evidence written before this artifact, the new agent-memory files and the issue #986 promoted record).
+- This artifact itself is written after the sweep; it is covered by the post-commit Committed-mode sweep run in P6-T3.
+
+Sweep output (verbatim):
+```
+MODE: WorkingTree
+TOKENS: ACCOUNT,HOST,EMAIL,ACCOUNT_SHORT
+CONTROL-SYNTHETIC: ACCOUNT=1 HOST=1 EMAIL=1 ACCOUNT_SHORT=1
+CONTROL-GITFILE-ACCOUNT: 1
+ADDED-OR-UNTRACKED-LINES: 5361
+UNTRACKED-FILE-COUNT: 34
+HITS-ACCOUNT: 0
+HITS-HOST: 0
+HITS-EMAIL: 0
+HITS-ACCOUNT_SHORT: 0
+HITS-USERS_PATH: 0
+HITS-TOTAL: 0
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.jacoco.xml b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.jacoco.xml
new file mode 100644
index 000000000..3265e9d05
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.jacoco.xml
@@ -0,0 +1,38 @@
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="2294" covered="10467" />
+    <counter type="BRANCH" missed="699" covered="2518" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="4603" covered="39160" />
+    <counter type="BRANCH" missed="1866" covered="9518" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="143" covered="1426" />
+    <counter type="BRANCH" missed="67" covered="333" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="977" covered="877" />
+    <counter type="BRANCH" missed="338" covered="300" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="762" covered="1061" />
+    <counter type="BRANCH" missed="260" covered="248" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="56" covered="702" />
+    <counter type="BRANCH" missed="16" covered="174" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="802" covered="2503" />
+    <counter type="BRANCH" missed="210" covered="524" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="11" covered="295" />
+    <counter type="BRANCH" missed="8" covered="94" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="4" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt
new file mode 100644
index 000000000..100bb2604
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt
@@ -0,0 +1,5 @@
+Test run outcome: Completed
+Total 7427, executed 7427, passed 7427, failed 0.
+Skipped 0, derived as total minus executed rather than reported by the test platform.
+Figures reported verbatim by the test platform: error 0, timeout 0, aborted 0, notExecuted 0, inconclusive 0.
+Failed tests: none
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze-r1.2026-10-09T15-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze-r1.2026-10-09T15-26.md
new file mode 100644
index 000000000..d61127db6
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze-r1.2026-10-09T15-26.md
@@ -0,0 +1,9 @@
+# PowerShell QA Lint (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-26
+Command: mcp__drm-copilot__run_poshqc_analyze workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true; summary (root substituted): "Ran bundled PoshQC analyze against 'WORKSPACE-ROOT' with 2 selected scan folder(s)."
+- Type checking: not applicable to PowerShell (`.claude/rules/powershell.md` toolchain step 3).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-25.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-25.md
new file mode 100644
index 000000000..9484bdf72
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-25.md
@@ -0,0 +1,13 @@
+# PowerShell Lint Gate (P4-T2)
+
+Timestamp: 2026-10-09T14-25
+Command: mcp__drm-copilot__run_poshqc_analyze workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 1
+ITERATION: 1
+Output Summary:
+- MCP ok: false; summary: Command exited with code 1; stderr: PSScriptAnalyzer reported 7 issue(s).
+- Diagnosis (Invoke-ScriptAnalyzer default rules over the five Write Set files):
+  - scripts/dependencies/BindingRedirectSync.psm1:52 and :55 PSUseOutputTypeCorrectly (Get-ProviderVersion returns Object[] not declared in OutputType)
+  - tests/scripts/dependencies/BindingRedirectSync.Tests.ps1:11, :31, :42, :56, :72 PSUseShouldProcessForStateChangingFunctions (helper functions named with the New verb)
+- Type checking: not applicable to PowerShell (.claude/rules/powershell.md toolchain step 3).
+- Result: FAIL. Loop restart per C7: Get-ProviderVersion returns its values unwrapped with OutputType([string]) and callers wrap with @(); the five test helpers are renamed to the Get verb. Iteration 2 restarts at P4-T1.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-26.md
new file mode 100644
index 000000000..81c81dd07
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-analyze.2026-10-09T14-26.md
@@ -0,0 +1,11 @@
+# PowerShell Lint Gate (P4-T2)
+
+Timestamp: 2026-10-09T14-26
+Command: mcp__drm-copilot__run_poshqc_analyze workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+ITERATION: 2
+Output Summary:
+- MCP ok: true; summary: Ran bundled PoshQC analyze against 'WORKSPACE-ROOT' with 2 selected scan folder(s).
+- The seven iteration-1 findings (PSUseOutputTypeCorrectly x2, PSUseShouldProcessForStateChangingFunctions x5) are resolved; a cross-check with Invoke-ScriptAnalyzer default rules over the five Write Set files reported 0 issues.
+- Type checking: not applicable to PowerShell (.claude/rules/powershell.md toolchain step 3).
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md
new file mode 100644
index 000000000..230702e1b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md
@@ -0,0 +1,18 @@
+# PowerShell QA Direct Coverage (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-29
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985r1-pester-final.xml
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 3; COVERAGE-PATH-COUNT: 3; Pester 5.6.1
+- PESTER Passed=447 Failed=0 Skipped=0 NotRun=0 Total=447 (baseline 438; +9 new tests)
+- COVERAGE LinePercent=94.99 Covered=1898 Total=1998 (gate 80.00: PASS)
+- FILE-COVERAGE scripts/dependencies/dependencies/BindingRedirectSync.psm1 LinePercent=100.00 Covered=120 Total=120 (gate 90.00: PASS)
+- FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=94.17 Covered=226 Total=240 (gate: not below R1-BASELINE-REPAIR-SCRIPT-LINE 94.14: PASS)
+- POLICY-85-OBSERVATION: MET (aggregate 94.99 is at or above 85)
+- FILE-TESTS BindingRedirectSync.Tests.ps1 Passed=24 Failed=0 Total=24
+- FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=9 Failed=0 Total=9
+- FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31
+- All other FILE-TESTS lines identical to the baseline (`remediation-baseline/ps-coverage.2026-10-09T15-19.md`), each Failed=0.
+- Raw JaCoCo document kept under the ignored `coverage/` directory (not copied into FEATURE).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md
new file mode 100644
index 000000000..a45183af2
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md
@@ -0,0 +1,39 @@
+# PowerShell Direct Coverage Gate (P4-T4)
+
+Timestamp: 2026-10-09T14-26
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985-pester-final.xml
+EXIT_CODE: 0
+ITERATION: 2
+Output Summary:
+- TEST-PATH-COUNT: 3; COVERAGE-PATH-COUNT: 3
+- PESTER Passed=438 Failed=0 Skipped=0 NotRun=0 Total=438 (baseline 413; +25 new tests)
+- COVERAGE LinePercent=94.98 Covered=1891 Total=1991 (gate: at or above 80.00; PASS)
+- FILE-COVERAGE scripts/dependencies/dependencies/BindingRedirectSync.psm1 LinePercent=100.00 Covered=114 Total=114 (gate: at or above 90.00; PASS)
+- FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=94.14 Covered=225 Total=239 (gate: at or above BASELINE-REPAIR-SCRIPT-LINE 93.83; PASS)
+- POLICY-85-OBSERVATION: MET (aggregate 94.98 is at or above the 85 figure in .claude/rules/quality-tiers.md; recorded as an observation per plan D6)
+- Raw JaCoCo document kept at coverage/985-pester-final.xml (ignored directory); not copied into the feature folder.
+- Result: PASS.
+
+## FILE-TESTS (new and changed files)
+
+```
+FILE-TESTS BindingRedirectSync.Tests.ps1 Passed=18 Failed=0 Total=18
+FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31
+FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=5 Failed=0 Total=5
+```
+
+All other 28 FILE-TESTS lines report Failed=0 with totals equal to the P0-T8 baseline.
+
+## FILE-COVERAGE scripts/dependencies
+
+```
+FILE-COVERAGE scripts/dependencies/dependencies/AnalyzerItemRepair.psm1 LinePercent=100.00 Covered=106 Total=106
+FILE-COVERAGE scripts/dependencies/dependencies/BindingRedirectSync.psm1 LinePercent=100.00 Covered=114 Total=114
+FILE-COVERAGE scripts/dependencies/dependencies/BindingRedirectVerification.psm1 LinePercent=100.00 Covered=41 Total=41
+FILE-COVERAGE scripts/dependencies/dependencies/ConsistencyVerifier.psm1 LinePercent=98.75 Covered=158 Total=160
+FILE-COVERAGE scripts/dependencies/dependencies/PackageCompatibility.psm1 LinePercent=100.00 Covered=33 Total=33
+FILE-COVERAGE scripts/dependencies/dependencies/PackageGraph.psm1 LinePercent=100.00 Covered=164 Total=164
+FILE-COVERAGE scripts/dependencies/dependencies/ProjectConsistency.psm1 LinePercent=100.00 Covered=103 Total=103
+FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=94.14 Covered=225 Total=239
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format-r1.2026-10-09T15-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format-r1.2026-10-09T15-26.md
new file mode 100644
index 000000000..dc7cb1b29
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format-r1.2026-10-09T15-26.md
@@ -0,0 +1,15 @@
+# PowerShell QA Format (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-26
+Command: mcp__drm-copilot__run_poshqc_format workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true; summary (root substituted): "Ran bundled PoshQC format against 'WORKSPACE-ROOT' with 2 selected scan folder(s)."
+- git status --porcelain: 25 lines before and after; SHA-256 of the joined lines BAE1ACB5E9E1F3ABE61EC386F93DBEDE8CFCBC884B229CBC984395B2B1DAB5CC before and after (identical).
+- git hash-object --no-filters, identical before and after:
+  - scripts/dependencies/BindingRedirectSync.psm1 da6f3f3bb8e1980dffd5f0af6137ab0f7423809a
+  - scripts/dependencies/Repair-PackageManifestConsistency.ps1 0883b91d1b2cc5222cd06f0514d4ad68ebd91159
+  - tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 d788259bc29f7c8c7ef24badb3726125e04698ba
+  - tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 b95cd3158c8324dc27013cdac4faa46d41ce6b53
+- Result: no file rewritten; no loop restart.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-25.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-25.md
new file mode 100644
index 000000000..6c3dd429e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-25.md
@@ -0,0 +1,16 @@
+# PowerShell Format Gate (P4-T1)
+
+Timestamp: 2026-10-09T14-25
+Command: mcp__drm-copilot__run_poshqc_format workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+ITERATION: 1
+Output Summary:
+- MCP ok: true; summary: Ran bundled PoshQC format against 'WORKSPACE-ROOT' with 2 selected scan folder(s).
+- Porcelain before and after: identical (21 lines).
+- Hashes before = after (no rewrite):
+  - scripts/dependencies/BindingRedirectSync.psm1 3542973912c539fc8ff63e38f68145d35a49274b
+  - scripts/dependencies/Repair-PackageManifestConsistency.ps1 2b845c5aad4952f581e26e66284e1901217c0198
+  - tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 fb37b258e3b7c755c20268d8c04fc106068beced
+  - tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 d82cfd5c6de703e82425c7be5cf2d078b071c990
+  - tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 a8c706095157d3a69ab21c79d93896e6588164d3
+- Result: PASS (no file rewritten; no loop restart).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-26.md
new file mode 100644
index 000000000..603f8b234
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-format.2026-10-09T14-26.md
@@ -0,0 +1,16 @@
+# PowerShell Format Gate (P4-T1)
+
+Timestamp: 2026-10-09T14-26
+Command: mcp__drm-copilot__run_poshqc_format workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+ITERATION: 2
+Output Summary:
+- MCP ok: true; summary: Ran bundled PoshQC format against 'WORKSPACE-ROOT' with 2 selected scan folder(s).
+- Porcelain before and after: identical (21 lines, same set as iteration 1).
+- Hashes before = after (no rewrite):
+  - scripts/dependencies/BindingRedirectSync.psm1 ef8eee178ce3296a872281467320860f759ffd27
+  - scripts/dependencies/Repair-PackageManifestConsistency.ps1 2b845c5aad4952f581e26e66284e1901217c0198
+  - tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 61b018e7270d5ca11d849a0300fe8514457c6533
+  - tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 d82cfd5c6de703e82425c7be5cf2d078b071c990
+  - tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 a8c706095157d3a69ab21c79d93896e6588164d3
+- Result: PASS (no file rewritten).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts-r1.2026-10-09T15-29.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts-r1.2026-10-09T15-29.md
new file mode 100644
index 000000000..6a43d682e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts-r1.2026-10-09T15-29.md
@@ -0,0 +1,12 @@
+# PowerShell Write Set Line Counts (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-29
+Command: Grep tool, pattern `^`, count mode, over the four PowerShell Write Set files
+EXIT_CODE: 0
+Output Summary:
+- scripts/dependencies/BindingRedirectSync.psm1: 328 (limit 500)
+- scripts/dependencies/Repair-PackageManifestConsistency.ps1: 495 (limit 500)
+- tests/scripts/dependencies/BindingRedirectSync.Tests.ps1: 440 (limit 500)
+- tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1: 218 (limit 500)
+- Result: PASS; no SIZE-LIMIT condition.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md
new file mode 100644
index 000000000..f18df9b61
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md
@@ -0,0 +1,12 @@
+# PowerShell Write Set Line Counts (P4-T6)
+
+Timestamp: 2026-10-09T14-26
+Command: Grep tool, pattern `^`, output mode count, over the five PowerShell Write Set files
+EXIT_CODE: 0
+Output Summary:
+- scripts/dependencies/BindingRedirectSync.psm1: 306
+- scripts/dependencies/Repair-PackageManifestConsistency.ps1: 493
+- tests/scripts/dependencies/BindingRedirectSync.Tests.ps1: 358
+- tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1: 187
+- tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1: 178
+- Result: every count at most 500; no SIZE-LIMIT.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md
new file mode 100644
index 000000000..3951169c7
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md
@@ -0,0 +1,11 @@
+# PowerShell Temporary-file Audit (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-29
+Command: Grep tool, pattern `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item`, count mode
+EXIT_CODE: 0
+Output Summary:
+- tests/scripts/dependencies/BindingRedirectSync.Tests.ps1: 0
+- tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1: 0
+- Positive control, scripts/dependencies/Repair-PackageManifestConsistency.ps1: 1 (line 373, the default writer's `WriteAllText`), so the matcher is live.
+- Result: PASS; no SWEEP-BLIND condition.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md
new file mode 100644
index 000000000..83f2818d0
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md
@@ -0,0 +1,12 @@
+# Temporary-file Audit (P4-T5)
+
+Timestamp: 2026-10-09T14-26
+Command: Grep tool, pattern `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item`, output mode count, over the three test files and the positive control
+EXIT_CODE: 0
+ITERATION: 2
+Output Summary:
+- tests/scripts/dependencies/BindingRedirectSync.Tests.ps1: 0
+- tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1: 0
+- tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1: 0
+- Positive control scripts/dependencies/Repair-PackageManifestConsistency.ps1: 1 (the default writer's WriteAllText), so the search tool reads the files.
+- Result: PASS; every new and changed test uses in-memory fixtures only; no SANITIZE-BLIND.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md
new file mode 100644
index 000000000..186d8d02f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md
@@ -0,0 +1,13 @@
+# PowerShell QA MCP Test (R1, issue #985)
+
+ITERATION: 1
+Timestamp: 2026-10-09T15-27
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT -Clear; mcp__drm-copilot__run_poshqc_test workspace_root = WORKSPACE-ROOT, scan_folders = [tests/scripts/dependencies]; pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT
+EXIT_CODE: 0
+Output Summary:
+- JUNIT-CLEARED: True
+- MCP ok: true; summary (root substituted): "Ran bundled PoshQC test against 'WORKSPACE-ROOT' with 1 selected scan folder(s)."
+- JUNIT tests=187 failures=0 errors=0 disabled=0 (baseline 178; +6 module tests, +3 entry-point tests)
+- JUNIT-SUITE BindingRedirectSync.Tests.ps1 tests=24 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 tests=9 failures=0
+- Other suites unchanged from baseline: AnalyzerItemRepair 13, BindingRedirectVerification 16, ConsistencyVerifier 14, DependabotConfig 17, PackageCompatibility 8, PackageGraph 32, ProjectConsistency 18, Repair-PackageManifestConsistency 31, RepositoryTreeConsistency 5; all failures=0.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp.2026-10-09T14-26.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp.2026-10-09T14-26.md
new file mode 100644
index 000000000..1bba9f6f1
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/ps-test-mcp.2026-10-09T14-26.md
@@ -0,0 +1,22 @@
+# PowerShell MCP Test Gate (P4-T3)
+
+Timestamp: 2026-10-09T14-26
+Command: pwsh -NoProfile -File CMDDIR\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT -Clear; mcp__drm-copilot__run_poshqc_test workspace_root = WORKSPACE-ROOT, scan_folders = [tests/scripts/dependencies]; pwsh -NoProfile -File CMDDIR\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT
+EXIT_CODE: 0
+ITERATION: 2
+Output Summary:
+- JUNIT-CLEARED: True
+- MCP ok: true; summary: Ran bundled PoshQC test against 'WORKSPACE-ROOT' with 1 selected scan folder(s).
+- JUNIT tests=178 failures=0 errors=0 disabled=0 (baseline 153; +18 BindingRedirectSync, +6 RedirectSync, +1 RepositoryTreeConsistency)
+- JUNIT-SUITE AnalyzerItemRepair.Tests.ps1 tests=13 failures=0
+- JUNIT-SUITE BindingRedirectSync.Tests.ps1 tests=18 failures=0
+- JUNIT-SUITE BindingRedirectVerification.Tests.ps1 tests=16 failures=0
+- JUNIT-SUITE ConsistencyVerifier.Tests.ps1 tests=14 failures=0
+- JUNIT-SUITE DependabotConfig.Tests.ps1 tests=17 failures=0
+- JUNIT-SUITE PackageCompatibility.Tests.ps1 tests=8 failures=0
+- JUNIT-SUITE PackageGraph.Tests.ps1 tests=32 failures=0
+- JUNIT-SUITE ProjectConsistency.Tests.ps1 tests=18 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 tests=6 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.Tests.ps1 tests=31 failures=0
+- JUNIT-SUITE RepositoryTreeConsistency.Tests.ps1 tests=5 failures=0
+- Result: PASS.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md
new file mode 100644
index 000000000..aaa59200f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md
@@ -0,0 +1,9 @@
+# AC4 Re-check: Workflows Untouched (R1, issue #985)
+
+Timestamp: 2026-10-09T15-30
+Command: git diff --name-only 9911fe138952e2b93476850582847c2831e1cbbd -- .github/workflows; git status --porcelain -- .github/workflows
+EXIT_CODE: 0
+Output Summary:
+- `git diff --name-only <BASE-SHA> -- .github/workflows`: (empty)
+- `git status --porcelain -- .github/workflows`: (empty)
+- Result: PASS; no file under `.github/workflows/**` differs from the merge base, committed or uncommitted.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched.2026-10-09T14-31.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched.2026-10-09T14-31.md
new file mode 100644
index 000000000..129002305
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/qa-gates/workflows-untouched.2026-10-09T14-31.md
@@ -0,0 +1,10 @@
+# Workflows Untouched (P5-T7, AC4)
+
+Timestamp: 2026-10-09T14-31
+Command: git diff --name-only BASE-SHA -- .github/workflows; git status --porcelain -- .github/workflows
+EXIT_CODE: 0
+Output Summary:
+- BASE-SHA: 9911fe138952e2b93476850582847c2831e1cbbd
+- `git diff --name-only BASE-SHA -- .github/workflows`: empty
+- `git status --porcelain -- .github/workflows`: empty (covers untracked files the name-only diff cannot list)
+- Result: PASS; no file under .github/workflows is modified or added. P8-T2 repeats the committed-range form after the last commit.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-identity-sweep.2026-10-09T15-20.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-identity-sweep.2026-10-09T15-20.md
new file mode 100644
index 000000000..19f02fc27
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-identity-sweep.2026-10-09T15-20.md
@@ -0,0 +1,28 @@
+# Fail-before: Identity Sweep (R1, B-1, issue #985)
+
+Timestamp: 2026-10-09T15-20
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985r1-identity-sweep.ps1 -WorkspaceRoot WORKSPACE-ROOT -Base 9911fe138952e2b93476850582847c2831e1cbbd -Mode WorkingTree
+EXIT_CODE: 1
+ExpectedExitCode: 1
+Output Summary:
+- Right reason: exit 1; every synthetic control =1; git-file control 1; the only hit is ACCOUNT at `plan.2026-10-09T13-06.md:26`.
+- FURTHER-HITS: NONE (no HIT- line other than the plan line 26).
+
+Output (verbatim; the script prints token names, counts and locations only):
+```
+MODE: WorkingTree
+TOKENS: ACCOUNT,HOST,EMAIL,ACCOUNT_SHORT
+CONTROL-SYNTHETIC: ACCOUNT=1 HOST=1 EMAIL=1 ACCOUNT_SHORT=1
+CONTROL-GITFILE-ACCOUNT: 1
+ADDED-OR-UNTRACKED-LINES: 4890
+UNTRACKED-FILE-COUNT: 16
+HITS-ACCOUNT: 1
+HIT-ACCOUNT: docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md:26
+HITS-HOST: 0
+HITS-EMAIL: 0
+HITS-ACCOUNT_SHORT: 0
+HITS-USERS_PATH: 0
+HITS-TOTAL: 1
+```
+
+Note: three git line-ending warnings (LF to CRLF on the three modified agent-memory files) were also printed on stderr; they carry no identifier and do not affect the result.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md
new file mode 100644
index 000000000..e77db2d12
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md
@@ -0,0 +1,30 @@
+# Fail-before: Orphaned HintPath Gate (P1-T3) [expect-fail]
+
+Timestamp: 2026-10-09T14-15
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
+EXIT_CODE: 1
+ExpectedExitCode: 1
+Output Summary:
+- TEST-PATH-COUNT: 1; COVERAGE-PATH-COUNT: 0
+- PESTER Passed=4 Failed=1 Skipped=0 NotRun=0 Total=5
+- FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=4 Failed=1 Total=5
+- FAILED-TEST: Repository tree consistency (issue 929).reports no HintPath whose package folder the sibling manifest does not declare, for every project directory that carries a manifest
+- FAILED-MESSAGE contains `QuickFiler.Test.csproj: line`, `UtilitiesCS.Test.csproj: line` and `TaskTree.Test.csproj: line` (right reason: borrowed packages before the manifest edits)
+- Finding count: 7 (research predicted 7; recorded, not gated)
+- P1-T1 static checks: Grep `It 'reports no HintPath whose package folder the sibling manifest does not declare` count 1; `Find-OrphanedHintPath -ProjectText` count 1; `AC[0-9]` in Describe/Context/It lines 0; file 178 lines, 178 CRLF.
+
+## Findings list (from FAILED-MESSAGE)
+
+1. QuickFiler.Test.csproj: line 389 Microsoft.Web.WebView2.1.0.4191.47
+2. QuickFiler.Test.csproj: line 392 Microsoft.Web.WebView2.1.0.4191.47
+3. QuickFiler.Test.csproj: line 407 ObjectListView.Official.2.9.1
+4. QuickFiler.Test.csproj: line 530 Microsoft.Web.WebView2.1.0.4191.47
+5. TaskTree.Test.csproj: line 178 ObjectListView.Official.2.9.1
+6. UtilitiesCS.Test.csproj: line 815 Microsoft.Web.WebView2.1.0.4191.47
+7. UtilitiesCS.Test.csproj: line 818 Microsoft.Web.WebView2.1.0.4191.47
+
+## FAILED-MESSAGE (verbatim)
+
+```
+FAILED-MESSAGE: Expected 0, because these HintPath elements name a package folder the sibling manifest does not declare: QuickFiler.Test.csproj: line 389 Microsoft.Web.WebView2.1.0.4191.47; QuickFiler.Test.csproj: line 392 Microsoft.Web.WebView2.1.0.4191.47; QuickFiler.Test.csproj: line 407 ObjectListView.Official.2.9.1; QuickFiler.Test.csproj: line 530 Microsoft.Web.WebView2.1.0.4191.47; TaskTree.Test.csproj: line 178 ObjectListView.Official.2.9.1; UtilitiesCS.Test.csproj: line 815 Microsoft.Web.WebView2.1.0.4191.47; UtilitiesCS.Test.csproj: line 818 Microsoft.Web.WebView2.1.0.4191.47, but got 7.
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md
new file mode 100644
index 000000000..d5e4d56d6
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md
@@ -0,0 +1,27 @@
+# Fail-before: Composition-root Redirect Sync (P1-T4) [expect-fail]
+
+Timestamp: 2026-10-09T14-15
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1
+EXIT_CODE: 1
+ExpectedExitCode: 1
+Output Summary:
+- TEST-PATH-COUNT: 1; COVERAGE-PATH-COUNT: 0
+- PESTER Passed=2 Failed=4 Skipped=0 NotRun=0 Total=6
+- Failed set: exactly R1 (rewrites the transitive redirect in both positions), R2 (reports the rewritten application configuration in the written paths), R3 (carries the synchronised-redirect block in the body), R4 (exposes the synchronisation in the RedirectSync field and not in the per-project repair records)
+- R5 (writes nothing on a second run over the repaired store) and R6 (leaves the stale redirect unchanged and writes nothing) passed
+- R1 FAILED-MESSAGE contains `newVersion` (the store still carries newVersion="3.4.0.0")
+- Right reason: the pre-change script has no unconditional sync pass and no RedirectSync result field.
+- P1-T2 static checks: Grep `^\s+It '` count 6; temporary-file pattern count 0; `RedirectSync` appears only inside It blocks (lines 161-170), 0 inside the BeforeAll blocks.
+
+## FAILED-TEST / FAILED-MESSAGE lines
+
+```
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied.rewrites the transitive redirect in both positions
+FAILED-MESSAGE: Expected regular expression 'oldVersion="0\.0\.0\.0-3\.5\.0\.0"' to match '... <bindingRedirect oldVersion="0.0.0.0-3.4.0.0" newVersion="3.4.0.0" /> ... <bindingRedirect oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0" /> ...', but it did not match.
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied.reports the rewritten application configuration in the written paths
+FAILED-MESSAGE: Expected 'X:\fixture\Test\app.config' to be found in collection $null, but it was not found.
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied.carries the synchronised-redirect block in the body
+FAILED-MESSAGE: Expected regular expression '## Binding redirects synchronised' to match '## Repairs applied No repairs were applied.', but it did not match.
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied.exposes the synchronisation in the RedirectSync field and not in the per-project repair records
+FAILED-MESSAGE: The property 'RedirectSync' cannot be found on this object. Verify that the property exists.
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-repair-written-path.2026-10-09T15-22.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-repair-written-path.2026-10-09T15-22.md
new file mode 100644
index 000000000..77e6cce0d
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-repair-written-path.2026-10-09T15-22.md
@@ -0,0 +1,24 @@
+# Fail-before: Repair entry-point redirect-sync tests (R1, CR-1 and CR-2, issue #985)
+
+Timestamp: 2026-10-09T15-22
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1
+EXIT_CODE: 1
+ExpectedExitCode: 1
+Output Summary:
+- Right reason: PESTER Passed=7 Failed=2 Skipped=0 NotRun=0 Total=9.
+- Failed set is exactly N7 (`states the direction of the synchronised redirect in the body`) and N9 (`lists the application configuration once in the written paths`).
+- N9 message: `Expected 1, but got 2.` (the application configuration is listed twice in WrittenPath).
+- N8 (`applies both rewrites to the application configuration`) passed, so both passes wrote the fixture.
+
+P2-T3 counts (`tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1`):
+- `^\s+It '`: 9; `^\s+Context '`: 3.
+- `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item`: 0.
+- Carriage returns (`\r$`): 0 (LF kept).
+
+Failed tests (verbatim):
+```
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied.states the direction of the synchronised redirect in the body
+FAILED-MESSAGE: Expected regular expression 'log4net 3\.4\.0\.0 to 3\.5\.0\.0 \(HighestDeployed, Upgrade\)' to match '## Repairs applied No repairs were applied.  ## Binding redirects synchronised - Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)', but it did not match.
+FAILED-TEST: Repair-PackageManifestConsistency redirect synchronisation (issue 985).An application configuration rewritten by both the redirect sync and the normalisation pass.lists the application configuration once in the written paths
+FAILED-MESSAGE: Expected 1, but got 2.
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md
new file mode 100644
index 000000000..c04ad7cc9
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md
@@ -0,0 +1,38 @@
+# Fail-before: BindingRedirectSync module tests (R1, CR-1 and CR-3, issue #985)
+
+Timestamp: 2026-10-09T15-22
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1
+EXIT_CODE: 1
+ExpectedExitCode: 1
+Output Summary:
+- Right reason: PESTER Passed=17 Failed=7 Skipped=0 NotRun=0 Total=24.
+- Failed set is exactly N1, N2, N3, N4, N5, N6 and `returns the heading and one line per repair`.
+- N1 to N4 fail on the absent `Direction` property; N5 fails with `Expected 1, but got 2.` (the case-variant block produced a second repair record); the two report tests fail because the line lacks the direction.
+
+P2-T1 counts (`tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`):
+- `^\s+It '`: 24 measured after P2-T1 and P2-T2 were both applied (18 before + 5 from P2-T1 + 1 from P2-T2); the P2-T1 value is therefore 23.
+- Each N1 to N5 `It` name: 1 (lines 272, 284, 299, 312, 325).
+- `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item`: 0.
+- Carriage returns (`\r$`): 0 (LF kept).
+
+P2-T2 counts:
+- `^\s+It '`: 24.
+- `\(HighestDeployed, Upgrade\)'`: 1; `\(OwnReference, Upgrade\)'`: 1; `\(HighestDeployed, Downgrade\)'`: 1; `\(HighestDeployed\)'`: 0.
+
+Failed tests (verbatim):
+```
+FAILED-TEST: Invoke-BindingRedirectSync (in-memory fixtures).marks a rewrite to a higher version as an upgrade
+FAILED-MESSAGE: The property 'Direction' cannot be found on this object. Verify that the property exists.
+FAILED-TEST: Invoke-BindingRedirectSync (in-memory fixtures).marks a rewrite to a lower version as a downgrade
+FAILED-MESSAGE: The property 'Direction' cannot be found on this object. Verify that the property exists.
+FAILED-TEST: Invoke-BindingRedirectSync (in-memory fixtures).marks the direction unknown when the stale version does not parse
+FAILED-MESSAGE: The property 'Direction' cannot be found on this object. Verify that the property exists.
+FAILED-TEST: Invoke-BindingRedirectSync (in-memory fixtures).marks the direction unknown when the two versions are numerically equal
+FAILED-MESSAGE: The property 'Direction' cannot be found on this object. Verify that the property exists.
+FAILED-TEST: Invoke-BindingRedirectSync (in-memory fixtures).processes an assembly name once when two blocks differ only in letter case
+FAILED-MESSAGE: Expected 1, but got 2.
+FAILED-TEST: Format-BindingRedirectSyncReport.returns the heading and one line per repair
+FAILED-MESSAGE: Expected strings to be the same, but they were different. Expected length: 66 Actual length:   57 Strings differ at index 56. Expected: '- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed, Upgrade)' But was:  '- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed)'
+FAILED-TEST: Format-BindingRedirectSyncReport.states a downgrade in the report line
+FAILED-MESSAGE: Expected strings to be the same, but they were different. Expected length: 68 Actual length:   57 Strings differ at index 56. Expected: '- Tags.Test: log4net 3.6.0.0 to 3.5.0.0 (HighestDeployed, Downgrade)' But was:  '- Tags.Test: log4net 3.6.0.0 to 3.5.0.0 (HighestDeployed)'
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-identity-sweep.2026-10-09T15-20.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-identity-sweep.2026-10-09T15-20.md
new file mode 100644
index 000000000..47fe17630
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-identity-sweep.2026-10-09T15-20.md
@@ -0,0 +1,25 @@
+# Pass-after: Identity Sweep (R1, B-1, issue #985)
+
+Timestamp: 2026-10-09T15-20
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985r1-identity-sweep.ps1 -WorkspaceRoot WORKSPACE-ROOT -Base 9911fe138952e2b93476850582847c2831e1cbbd -Mode WorkingTree
+EXIT_CODE: 0
+Output Summary:
+- HITS-TOTAL: 0; every HITS- line 0; CONTROL-SYNTHETIC all =1; CONTROL-GITFILE-ACCOUNT: 1.
+- P1-T2 (plan.2026-10-09T13-06.md line 26): Grep -o `<encoded-worktree>.<session-id>.scratchpad` = 2 matches, both line 26; Grep -o `claude.C--Users-` = 0; line count 643 before (HEAD) and 643 after; `git diff --numstat HEAD` = 1 added, 1 removed.
+- P1-T3: FURTHER-HITS: NONE (P1-T1 listed no hit other than plan line 26); no file rewritten beyond line 26; no XML-family file touched.
+
+Sweep output (verbatim):
+```
+MODE: WorkingTree
+TOKENS: ACCOUNT,HOST,EMAIL,ACCOUNT_SHORT
+CONTROL-SYNTHETIC: ACCOUNT=1 HOST=1 EMAIL=1 ACCOUNT_SHORT=1
+CONTROL-GITFILE-ACCOUNT: 1
+ADDED-OR-UNTRACKED-LINES: 4918
+UNTRACKED-FILE-COUNT: 17
+HITS-ACCOUNT: 0
+HITS-HOST: 0
+HITS-EMAIL: 0
+HITS-ACCOUNT_SHORT: 0
+HITS-USERS_PATH: 0
+HITS-TOTAL: 0
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md
new file mode 100644
index 000000000..cb2b45b5e
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md
@@ -0,0 +1,11 @@
+# Pass-after: Orphaned HintPath Gate (P2-T7)
+
+Timestamp: 2026-10-09T14-17
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 1; COVERAGE-PATH-COUNT: 0
+- PESTER Passed=5 Failed=0 Skipped=0 NotRun=0 Total=5
+- FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=5 Failed=0 Total=5
+- No FAILED-TEST line.
+- Result: after the four manifest declarations and the duplicate WebView2.Core removal, the gate reports zero orphaned HintPath findings (fail-before: 7, see fail-before-orphaned-hintpath.2026-10-09T14-15.md).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md
new file mode 100644
index 000000000..b3a4663f5
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md
@@ -0,0 +1,14 @@
+# Pass-after: Redirect Sync Module and Wiring (P3-T5)
+
+Timestamp: 2026-10-09T14-21
+Command: pwsh -NoProfile -File CMDDIR\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 3; COVERAGE-PATH-COUNT: 0
+- PESTER Passed=55 Failed=0 Skipped=0 NotRun=0 Total=55
+- FILE-TESTS BindingRedirectSync.Tests.ps1 Passed=18 Failed=0 Total=18
+- FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=6 Failed=0 Total=6
+- FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31 (equal to the P0-T8 baseline Total=31; existing contexts unchanged and green)
+- R1 to R4 now pass (fail-before: fail-before-redirect-sync.2026-10-09T14-15.md); R5 and R6 still pass.
+- P3-T4 static checks: `^\s+It '` count 18; temporary-file pattern count 0.
+- Behaviours pinned (AC2): stale-only rewrite (S3), own-reference preference (S5), highest by [System.Version] (S6, S7), unverifiable (S4), unresolvable (S8), idempotent second run with no repairs and no writes (S3, R5), -WhatIf writes nothing (S15, R6), unconditional invocation without -CandidateUpgrade (R1 to R4), RedirectSync field separate from Verification[].Report.Repair (R4).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-repair-written-path.2026-10-09T15-23.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-repair-written-path.2026-10-09T15-23.md
new file mode 100644
index 000000000..b69fbc74b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-repair-written-path.2026-10-09T15-23.md
@@ -0,0 +1,11 @@
+# Pass-after: Repair entry-point tests (R1, CR-1 and CR-2, issue #985)
+
+Timestamp: 2026-10-09T15-23
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 2; Pester 5.6.1
+- PESTER Passed=40 Failed=0 Skipped=0 NotRun=0 Total=40
+- FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=9 Failed=0 Total=9
+- FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31 (equals R1-BASELINE-REPAIR-TESTS-TOTAL 31)
+- N7 and N9, which failed in `fail-before-repair-written-path.2026-10-09T15-22.md`, now pass; N8 still passes.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-sync-module.2026-10-09T15-23.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-sync-module.2026-10-09T15-23.md
new file mode 100644
index 000000000..3b25f1c5c
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/regression-testing/pass-after-sync-module.2026-10-09T15-23.md
@@ -0,0 +1,10 @@
+# Pass-after: BindingRedirectSync module tests (R1, CR-1 and CR-3, issue #985)
+
+Timestamp: 2026-10-09T15-23
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 1; Pester 5.6.1
+- PESTER Passed=24 Failed=0 Skipped=0 NotRun=0 Total=24
+- FILE-TESTS BindingRedirectSync.Tests.ps1 Passed=24 Failed=0 Total=24
+- No FAILED-TEST line. The seven tests that failed in `fail-before-sync-module.2026-10-09T15-22.md` (N1 to N6 and the modified report test) now pass.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/git-state.2026-10-09T15-13.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/git-state.2026-10-09T15-13.md
new file mode 100644
index 000000000..b686a17f0
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/git-state.2026-10-09T15-13.md
@@ -0,0 +1,27 @@
+# Git State at R1 Start (issue #985)
+
+Timestamp: 2026-10-09T15-13
+Command: git rev-parse --abbrev-ref HEAD; git rev-parse HEAD; git merge-base HEAD origin/main; git status --porcelain
+EXIT_CODE: 0
+Output Summary:
+- Branch: bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985 (matches)
+- R1-START-SHA: de397b992868882530a447c662d21b3fbff123eb
+- BASE-SHA: 9911fe138952e2b93476850582847c2831e1cbbd (equals the value named in plan C1)
+- PreExistingWorktreePaths: 12 lines (below)
+
+PreExistingWorktreePaths:
+```
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/feature-review/MEMORY.md
+ M .claude/agent-memory/feature-review/project_review-residuals-index.md
+?? .claude/agent-memory/atomic-planner/project_985_r1_scratchpad_identity_and_double_write_seams.md
+?? .claude/agent-memory/feature-review/project_985-review-residuals.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T14-55.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T14-55.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-inputs.2026-10-09T14-55.md
+?? docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-plan.2026-10-09T14-55.md
+?? docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md
+```
+
+Note: the status was captured before P0-T1's evidence file was written; that file is the only addition made by this cycle at this point.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/helper-scripts.2026-10-09T15-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/helper-scripts.2026-10-09T15-15.md
new file mode 100644
index 000000000..86771b63a
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/helper-scripts.2026-10-09T15-15.md
@@ -0,0 +1,17 @@
+# Helper Scripts (R1, issue #985)
+
+Timestamp: 2026-10-09T15-15
+Command: git hash-object --no-filters <SCRATCH>\985r1-cmd\<name> (for each of the four helpers)
+EXIT_CODE: 0
+Output Summary:
+- 4 helper scripts written with the Write tool into `<SCRATCH>\985r1-cmd\` (outside the repository; never committed).
+- `985-pester.ps1`, `985-junit.ps1`, `985-repair.ps1`: copied from `plan.2026-10-09T13-06.md` lines 248-307, 313-329, 335-361, with `Format-SafeLine` (lines 85-94) pasted directly after each `param` block.
+- `985r1-identity-sweep.ps1`: verbatim from remediation plan section 5.
+- Backslash check: the doubled-backslash character classes survived the write (Grep for the two-backslash-slash form: 2 lines in the sweep script, 1 line in each of the other three).
+
+| Name | Path | git hash-object --no-filters |
+|---|---|---|
+| 985-pester.ps1 | `<SCRATCH>\985r1-cmd\985-pester.ps1` | 74ddc15e1a935c4b5dbd0efa4a72b63d9fcc0913 |
+| 985-junit.ps1 | `<SCRATCH>\985r1-cmd\985-junit.ps1` | 4df03fc0b964ac2d337c37141a5266f89b5c96a3 |
+| 985-repair.ps1 | `<SCRATCH>\985r1-cmd\985-repair.ps1` | 5cc7c5caaa7f90e37076de4ead07ce66332fe948 |
+| 985r1-identity-sweep.ps1 | `<SCRATCH>\985r1-cmd\985r1-identity-sweep.ps1` | dbc71b4b34ca68a13ccfa15b37b6005d473f6a9e |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/phase0-instructions-read.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/phase0-instructions-read.md
new file mode 100644
index 000000000..c851ac95a
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/phase0-instructions-read.md
@@ -0,0 +1,23 @@
+# Phase 0 Instructions Read (Remediation R1, issue #985)
+
+Timestamp: 2026-10-09T15-13
+Policy Order: CLAUDE.md -> .claude/rules/general-code-change.md -> .claude/rules/general-unit-test.md -> .claude/rules/quality-tiers.md -> .claude/rules/powershell.md -> .claude/rules/tonality.md -> .claude/rules/plan-acceptance-gates.md -> .claude/skills/atomic-plan-contract/SKILL.md -> .claude/skills/evidence-and-timestamp-conventions/SKILL.md -> .claude/skills/acceptance-criteria-tracking/SKILL.md -> .claude/agent-memory/_shared_no_absolute_host_paths.md -> remediation inputs -> code review -> spec
+
+Files Read:
+1. `CLAUDE.md`
+2. `.claude/rules/general-code-change.md`
+3. `.claude/rules/general-unit-test.md`
+4. `.claude/rules/quality-tiers.md`
+5. `.claude/rules/powershell.md`
+6. `.claude/rules/tonality.md`
+7. `.claude/rules/plan-acceptance-gates.md`
+8. `.claude/skills/atomic-plan-contract/SKILL.md`
+9. `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`
+10. `.claude/skills/acceptance-criteria-tracking/SKILL.md`
+11. `.claude/agent-memory/_shared_no_absolute_host_paths.md`
+12. `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-inputs.2026-10-09T14-55.md`
+13. `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md`
+14. `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md`
+
+Notes:
+- Work Mode full-bug; AC source `spec.md`. AC1 to AC6 are `[x]`, AC7 is `[ ]` at the start of R1. This cycle changes no AC text and checks off no AC.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-analyze.2026-10-09T15-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-analyze.2026-10-09T15-15.md
new file mode 100644
index 000000000..ab6be4724
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-analyze.2026-10-09T15-15.md
@@ -0,0 +1,9 @@
+# PowerShell Baseline Lint (R1, issue #985)
+
+Timestamp: 2026-10-09T15-15
+Command: mcp__drm-copilot__run_poshqc_analyze workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true
+- MCP summary (workspace root substituted per C3): "Ran bundled PoshQC analyze against 'WORKSPACE-ROOT' with 2 selected scan folder(s)."
+- Type checking: not applicable to PowerShell (`.claude/rules/powershell.md` toolchain step 3).
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-coverage.2026-10-09T15-19.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-coverage.2026-10-09T15-19.md
new file mode 100644
index 000000000..aed6b0e6c
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-coverage.2026-10-09T15-19.md
@@ -0,0 +1,54 @@
+# PowerShell Baseline Direct Coverage (R1, issue #985)
+
+Timestamp: 2026-10-09T15-19
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-pester.ps1 -WorkspaceRoot WORKSPACE-ROOT -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985r1-pester-baseline.xml
+EXIT_CODE: 0
+Output Summary:
+- TEST-PATH-COUNT: 3; COVERAGE-PATH-COUNT: 3; Pester 5.6.1
+- PESTER Passed=438 Failed=0 Skipped=0 NotRun=0 Total=438
+- COVERAGE LinePercent=94.98 Covered=1891 Total=1991
+- FILE-COVERAGE scripts/dependencies/dependencies/BindingRedirectSync.psm1 LinePercent=100.00 Covered=114 Total=114
+- FILE-COVERAGE scripts/dependencies/dependencies/Repair-PackageManifestConsistency.ps1 LinePercent=94.14 Covered=225 Total=239
+- R1-BASELINE-PS-AGGREGATE: 94.98
+- R1-BASELINE-MODULE-LINE: 100.00
+- R1-BASELINE-REPAIR-SCRIPT-LINE: 94.14
+- R1-BASELINE-REPAIR-TESTS-TOTAL: 31
+- Raw JaCoCo document kept under the ignored `coverage/` directory (not copied into FEATURE).
+
+FILE-TESTS lines:
+```
+FILE-TESTS AnalyzerItemRepair.Tests.ps1 Passed=13 Failed=0 Total=13
+FILE-TESTS BindingRedirectSync.Tests.ps1 Passed=18 Failed=0 Total=18
+FILE-TESTS BindingRedirectVerification.Tests.ps1 Passed=16 Failed=0 Total=16
+FILE-TESTS ConsistencyVerifier.Tests.ps1 Passed=14 Failed=0 Total=14
+FILE-TESTS DependabotConfig.Tests.ps1 Passed=17 Failed=0 Total=17
+FILE-TESTS Install-RepoDotNetSdk.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Invoke-MSTest.AssemblyDiscovery.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Invoke-MSTest.Main.Tests.ps1 Passed=12 Failed=0 Total=12
+FILE-TESTS Invoke-MSTest.ResultsDirectory.Tests.ps1 Passed=3 Failed=0 Total=3
+FILE-TESTS Invoke-MSTest.RunSettings.Tests.ps1 Passed=28 Failed=0 Total=28
+FILE-TESTS Invoke-MSTest.TrxSummary.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-MSTestWithCoverage.AssemblyDiscovery.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Invoke-MSTestWithCoverage.ClosureFilter.Tests.ps1 Passed=12 Failed=0 Total=12
+FILE-TESTS Invoke-MSTestWithCoverage.FirstParty.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-MSTestWithCoverage.Helpers.Tests.ps1 Passed=20 Failed=0 Total=20
+FILE-TESTS Invoke-MSTestWithCoverage.Merge.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Invoke-MSTestWithCoverage.PackageRate.Tests.ps1 Passed=2 Failed=0 Total=2
+FILE-TESTS Invoke-MSTestWithCoverage.Projection.Tests.ps1 Passed=11 Failed=0 Total=11
+FILE-TESTS Invoke-MSTestWithCoverage.ResultsDirectory.Tests.ps1 Passed=9 Failed=0 Total=9
+FILE-TESTS Invoke-MSTestWithCoverage.Scope.Tests.ps1 Passed=22 Failed=0 Total=22
+FILE-TESTS Invoke-MSTestWithCoverage.Threshold.Tests.ps1 Passed=13 Failed=0 Total=13
+FILE-TESTS Invoke-Restore.Tests.ps1 Passed=7 Failed=0 Total=7
+FILE-TESTS Invoke-VSBuild.Tests.ps1 Passed=16 Failed=0 Total=16
+FILE-TESTS PackageCompatibility.Tests.ps1 Passed=8 Failed=0 Total=8
+FILE-TESTS PackageGraph.Tests.ps1 Passed=32 Failed=0 Total=32
+FILE-TESTS ProjectConsistency.Tests.ps1 Passed=18 Failed=0 Total=18
+FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=6 Failed=0 Total=6
+FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 Passed=31 Failed=0 Total=31
+FILE-TESTS RepositoryTreeConsistency.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Sync-PackageReferences.Tests.ps1 Passed=15 Failed=0 Total=15
+FILE-TESTS Test-RepositoryHygiene.Git.Tests.ps1 Passed=5 Failed=0 Total=5
+FILE-TESTS Test-RepositoryHygiene.Rules.Tests.ps1 Passed=29 Failed=0 Total=29
+FILE-TESTS Test-RepositoryHygiene.Tests.ps1 Passed=15 Failed=0 Total=15
+FILE-TESTS TestProcessCleanup.Tests.ps1 Passed=5 Failed=0 Total=5
+```
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-format.2026-10-09T15-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-format.2026-10-09T15-15.md
new file mode 100644
index 000000000..a20c9b479
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-format.2026-10-09T15-15.md
@@ -0,0 +1,15 @@
+# PowerShell Baseline Format (R1, issue #985)
+
+Timestamp: 2026-10-09T15-15
+Command: mcp__drm-copilot__run_poshqc_format workspace_root = WORKSPACE-ROOT, scan_folders = [scripts/dependencies, tests/scripts/dependencies]
+EXIT_CODE: 0
+Output Summary:
+- MCP ok: true
+- MCP summary (workspace root substituted per C3): "Ran bundled PoshQC format against 'WORKSPACE-ROOT' with 2 selected scan folder(s)."
+- git status --porcelain: identical before and after (12 lines each).
+- git hash-object --no-filters, identical before and after:
+  - scripts/dependencies/BindingRedirectSync.psm1 ef8eee178ce3296a872281467320860f759ffd27
+  - scripts/dependencies/Repair-PackageManifestConsistency.ps1 2b845c5aad4952f581e26e66284e1901217c0198
+  - tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 61b018e7270d5ca11d849a0300fe8514457c6533
+  - tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 d82cfd5c6de703e82425c7be5cf2d078b071c990
+- Result: no rewrite; no BASELINE-FORMAT-DRIFT.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-test-mcp.2026-10-09T15-16.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-test-mcp.2026-10-09T15-16.md
new file mode 100644
index 000000000..2d65d168a
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/ps-test-mcp.2026-10-09T15-16.md
@@ -0,0 +1,20 @@
+# PowerShell Baseline MCP Test (R1, issue #985)
+
+Timestamp: 2026-10-09T15-16
+Command: pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT -Clear; mcp__drm-copilot__run_poshqc_test workspace_root = WORKSPACE-ROOT, scan_folders = [tests/scripts/dependencies]; pwsh -NoProfile -File <SCRATCH>\985r1-cmd\985-junit.ps1 -WorkspaceRoot WORKSPACE-ROOT
+EXIT_CODE: 0
+Output Summary:
+- JUNIT-CLEARED: True
+- MCP ok: true; summary (root substituted): "Ran bundled PoshQC test against 'WORKSPACE-ROOT' with 1 selected scan folder(s)."
+- JUNIT tests=178 failures=0 errors=0 disabled=0
+- JUNIT-SUITE AnalyzerItemRepair.Tests.ps1 tests=13 failures=0
+- JUNIT-SUITE BindingRedirectSync.Tests.ps1 tests=18 failures=0
+- JUNIT-SUITE BindingRedirectVerification.Tests.ps1 tests=16 failures=0
+- JUNIT-SUITE ConsistencyVerifier.Tests.ps1 tests=14 failures=0
+- JUNIT-SUITE DependabotConfig.Tests.ps1 tests=17 failures=0
+- JUNIT-SUITE PackageCompatibility.Tests.ps1 tests=8 failures=0
+- JUNIT-SUITE PackageGraph.Tests.ps1 tests=32 failures=0
+- JUNIT-SUITE ProjectConsistency.Tests.ps1 tests=18 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 tests=6 failures=0
+- JUNIT-SUITE Repair-PackageManifestConsistency.Tests.ps1 tests=31 failures=0
+- JUNIT-SUITE RepositoryTreeConsistency.Tests.ps1 tests=5 failures=0
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/tree-facts.2026-10-09T15-15.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/tree-facts.2026-10-09T15-15.md
new file mode 100644
index 000000000..18e658c19
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/evidence/remediation-baseline/tree-facts.2026-10-09T15-15.md
@@ -0,0 +1,24 @@
+# Pre-change Tree Facts (R1, issue #985)
+
+Timestamp: 2026-10-09T15-15
+Command: Grep tool (count / content -o) over the four Write Set PowerShell files and FEATURE/plan.2026-10-09T13-06.md
+EXIT_CODE: 0
+Output Summary:
+- All 14 observed values equal the plan's parenthesised values; no anchor re-derivation required.
+
+| Fact | Pattern | Expected | Observed |
+|---|---|---|---|
+| Lines, `scripts/dependencies/BindingRedirectSync.psm1` | `^` | 306 | 306 |
+| Lines, `scripts/dependencies/Repair-PackageManifestConsistency.ps1` | `^` | 493 | 493 |
+| Lines, `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` | `^` | 358 | 358 |
+| Lines, `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` | `^` | 187 | 187 |
+| CR, `BindingRedirectSync.psm1` | `\r$` | 0 | 0 |
+| CR, `Repair-PackageManifestConsistency.ps1` | `\r$` | 493 | 493 |
+| CR, `BindingRedirectSync.Tests.ps1` | `\r$` | 0 | 0 |
+| CR, `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` | `\r$` | 0 | 0 |
+| `BindingRedirectSync.psm1` | `\$handled\.Contains\(` | 1 | 1 (line 121) |
+| `BindingRedirectSync.psm1` | `function Get-RedirectDirection` | 0 | 0 |
+| `BindingRedirectSync.psm1` | `Direction` | 0 | 0 |
+| `Repair-PackageManifestConsistency.ps1` | `distinctWritten` | 0 | 0 |
+| `plan.2026-10-09T13-06.md` (-o) | `claude.C--Users-` | 2, both line 26 | 2, both line 26 |
+| `plan.2026-10-09T13-06.md` (-o) | `<encoded-worktree>` | 0 | 0 |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T14-55.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T14-55.md
new file mode 100644
index 000000000..98dc0c431
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T14-55.md
@@ -0,0 +1,60 @@
+# Feature Audit: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Review timestamp: 2026-10-09T14-55
+- Work mode: `full-bug` (marker `- Work Mode: full-bug` in `issue.md`); AC source: `spec.md` only
+
+## Scope and Baseline
+
+- Base branch: `origin/main` (caller-supplied; re-derived with `git merge-base HEAD origin/main`)
+- Merge base: `9911fe138952e2b93476850582847c2831e1cbbd` (2026-10-07T08:22:27-04:00)
+- Head: `de397b992868882530a447c662d21b3fbff123eb` (3 commits: `c83b6a965`, `79385ad07`, `de397b992`)
+- Diff: `git diff 9911fe138...HEAD`, 70 files, +3945/-609
+- PR context: `artifacts/pr_context.summary.txt` generated 2026-10-09 18:51:01 UTC for head `de397b992` (current); `artifacts/pr_context.appendix.txt` alongside.
+- Baseline behaviour: on main, `QuickFiler.Test`, `UtilitiesCS.Test` and `TaskTree.Test` hint-path packages their manifests do not declare (7 orphaned HintPaths, `evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md`), and the repair script has no redirect pass reachable without `-CandidateUpgrade` (`evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md`).
+
+## Acceptance Criteria Inventory
+
+| ID | Criterion (abridged) | Evidence class | Source state at review start |
+|---|---|---|---|
+| AC1 | Borrowed packages declared at sibling versions; duplicate WebView2.Core reference group removed, one reference remains | pre-merge | checked |
+| AC2 | `BindingRedirectSync.psm1` exports three functions; behaviours pinned by Pester; repair script invokes unconditionally, separate `RedirectSync` field, no sync records in `Report.Repair`, within file-size limit | pre-merge | checked |
+| AC3 | Orphaned-HintPath Pester gate with positive examined count; fail-first and pass-after evidence | pre-merge | checked |
+| AC4 | No file under `.github/workflows/**` modified | pre-merge | checked |
+| AC5 | In-memory fixtures only; new-module coverage meets target; PowerShell and C# toolchains pass in a single pass | pre-merge | checked |
+| AC6 | Local integration rehearsal on PR #984 branch: repair, restore, nullable and analyzer rebuilds succeed; BindingRedirectVerification passes; projections stored | pre-merge (local) | checked |
+| AC7 | Post-merge: all required checks on PR #984 pass after `@dependabot recreate`, and the repair re-run writes nothing | pending CI | unchecked |
+
+## Acceptance Criteria Evaluation
+
+| ID | Verdict | Evidence and reviewer verification |
+|---|---|---|
+| AC1 | PASS | Reviewer Grep: `QuickFiler.Test/packages.config` lines 42 (WebView2 1.0.4191.47) and 47 (ObjectListView.Official 2.9.1); `UtilitiesCS.Test/packages.config` line 64 (WebView2 1.0.4191.47); `TaskTree.Test/packages.config` line 41 (ObjectListView.Official 2.9.1). Production siblings: `QuickFiler/packages.config` 19 and 22, `UtilitiesCS/packages.config` 57, `TaskTree/packages.config` 8, same versions. HintPaths in the three test csproj files name `Microsoft.Web.WebView2.1.0.4191.47` and `ObjectListView.Official.2.9.1`. `Include="Microsoft.Web.WebView2.Core` count in `QuickFiler.Test.csproj`: 1. |
+| AC2 | PASS | Module exports the three functions (`Export-ModuleMember`, lines 302-306). Pinned behaviours: stale-only and idempotent (`It` "leaves a redirect whose newVersion is already deployed unchanged..."), own-reference preference, highest by `[System.Version]` (3.10.0.0 versus 3.9.0.0), ambiguous own reference fallback, unverifiable, unresolvable, `-WhatIf`, second run writes nothing (`RedirectSync.Tests.ps1`). Wiring: unconditional call at lines 449-450 with no `-CandidateUpgrade` guard; `RedirectSync` field lines 487-491; `Report.Repair` exclusion asserted in the RedirectSync suite. Repair script 493 lines. Reviewer re-run: 178/178 pass. |
+| AC3 | PASS | New `It` in `RepositoryTreeConsistency.Tests.ps1` asserts `$examined -gt 0` and zero findings. Fail-before: exit 1 with 7 findings naming the three projects; pass-after: 5/5 (`evidence/regression-testing/`). Reviewer re-run includes the suite, passing. |
+| AC4 | PASS | Reviewer: `git diff --name-only 9911fe138...HEAD -- .github` is empty; also `scripts/benchmarks` and `.github/actions` empty. |
+| AC5 | PASS | Temporary-file audit 0 in all three test files; reviewer read confirms in-memory stores. New module 100.00% lines (114/114), above the 90% new-code target, confirmed by reviewer in-session coverage. PowerShell toolchain iteration 2 clean (format, analyze, test); C# toolchain iteration 1 clean (CSharpier, analyzer rebuild, nullable rebuild, MSTest 7427/7427). |
+| AC6 | PASS | `evidence/other/integration-rehearsal.2026-10-09T14-35.md`: repair exit 0, 7 synchronised redirects, idempotent re-run writes 0; restore exit 0; analyzer and nullable `/t:Rebuild` 0 errors over 18 assemblies; `BindingRedirectVerification.Tests.ps1` 16/16. Evidence is projected summaries, not raw TRX or coverage documents. The rehearsal simulated the Dependabot bump of the two new test-project WebView2 entries (fidelity note D1), which AC7 confirms in the real flow. |
+| AC7 | PENDING CI | Requires merge, `@dependabot recreate` on PR #984 and observed CI; cannot be verified before merge. Owned by the item's orchestrator run per `acceptance-criteria-tracking` (CI-dependent criteria). Not counted as a blocking finding. |
+
+## Summary
+
+- Total AC items: 7
+- PASS: 6 (AC1 to AC6)
+- PARTIAL: 0
+- FAIL: 0
+- PENDING CI: 1 (AC7)
+- Review verdict for the branch: REMEDIATION_REQUIRED because of policy finding B-1 (account name in the committed plan, autonomous), which is independent of the acceptance criteria. No acceptance criterion is blocked.
+
+### Acceptance Criteria Status
+
+- Source: `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md`
+- Total AC items: 7
+- Checked off (delivered): 6
+- Remaining (unchecked): 1
+- Items remaining: AC7 (pending CI after merge and `@dependabot recreate` on PR #984)
+
+## Acceptance Criteria Check-off
+
+- AC1 to AC6 were already checked off in `spec.md` by the executor; the reviewer's evaluation confirms each as PASS, so no change to the source file was required.
+- AC7 remains unchecked (pending CI).
+- No criterion text was modified and no new criterion was added.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T15-35.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T15-35.md
new file mode 100644
index 000000000..a9dcdf70f
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T15-35.md
@@ -0,0 +1,61 @@
+# Feature Audit: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Review timestamp: 2026-10-09T15-35 (re-audit after remediation cycle R1)
+- Work mode: `full-bug` (marker `- Work Mode: full-bug` in `issue.md`); AC source: `spec.md` only
+
+## Scope and Baseline
+
+- Base branch: `origin/main` (caller-supplied; matches the PR-context resolved base)
+- Merge base: `9911fe138952e2b93476850582847c2831e1cbbd` (2026-10-07T08:22:27-04:00)
+- Head: `07d3a8a982d605eeb3bca77810955b4de5773ea8` (4 commits: `c83b6a965`, `79385ad07`, `de397b992`, `07d3a8a98`)
+- Diff: `git diff 9911fe138...HEAD`, 107 files, +5386/-691
+- PR context: `artifacts/pr_context.summary.txt` generated 2026-10-09 19:32:00 UTC for head `07d3a8a98` (current); `artifacts/pr_context.appendix.txt` alongside.
+- Baseline behaviour: on main, `QuickFiler.Test`, `UtilitiesCS.Test` and `TaskTree.Test` hint-path packages their manifests do not declare (7 orphaned HintPaths, `evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md`), and the repair script has no redirect pass reachable without `-CandidateUpgrade` (`evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md`).
+- Prior review: `2026-10-09T14-55` (REMEDIATION_REQUIRED, B-1). R1 closed B-1 and the in-scope code observations CR-1 to CR-3.
+
+## Acceptance Criteria Inventory
+
+| ID | Criterion (abridged) | Evidence class | Source state at review start |
+|---|---|---|---|
+| AC1 | Borrowed packages declared at sibling versions; duplicate WebView2.Core reference group removed, one reference remains | pre-merge | checked |
+| AC2 | `BindingRedirectSync.psm1` exports three functions; behaviours pinned by Pester; repair script invokes unconditionally, separate `RedirectSync` field, no sync records in `Report.Repair`, within file-size limit | pre-merge | checked |
+| AC3 | Orphaned-HintPath Pester gate with positive examined count; fail-first and pass-after evidence | pre-merge | checked |
+| AC4 | No file under `.github/workflows/**` modified | pre-merge | checked |
+| AC5 | In-memory fixtures only; new-module coverage meets target; PowerShell and C# toolchains pass in a single pass | pre-merge | checked |
+| AC6 | Local integration rehearsal on PR #984 branch: repair, restore, nullable and analyzer rebuilds succeed; BindingRedirectVerification passes; projections stored | pre-merge (local) | checked |
+| AC7 | Post-merge: all required checks on PR #984 pass after `@dependabot recreate`, and the repair re-run writes nothing | pending CI | unchecked |
+
+## Acceptance Criteria Evaluation
+
+| ID | Verdict | Evidence and reviewer verification |
+|---|---|---|
+| AC1 | PASS | Manifests and csproj unchanged by R1 (`git show --stat 07d3a8a98` lists no C#-family file). Prior reviewer verification stands: declarations at WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1 in the three test manifests, matching production siblings and HintPath folders; one `Microsoft.Web.WebView2.Core` reference remains in `QuickFiler.Test.csproj`. |
+| AC2 | PASS | `Export-ModuleMember` (lines 324-328) lists the three public functions; the new `Get-RedirectDirection` is private. Stale-only, own-reference preference, highest by `[System.Version]`, unverifiable, unresolvable and idempotent behaviours remain pinned; reviewer run of `BindingRedirectSync.Tests.ps1` (24) and `RedirectSync.Tests.ps1` (9) passes. Wiring unchanged (unconditional call, `RedirectSync` field, `Report.Repair` exclusion asserted). Repair script 495 lines, within the limit. |
+| AC3 | PASS | Unchanged by R1; reviewer run includes `RepositoryTreeConsistency.Tests.ps1`, passing. |
+| AC4 | PASS | Reviewer: `git diff --name-only 9911fe138...HEAD -- .github scripts/benchmarks .github/actions` is empty; executor R1 re-check `evidence/qa-gates/workflows-untouched-r1.2026-10-09T15-30.md`. |
+| AC5 | PASS | Temporary-file audit 0 in both R1-changed test files (`evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md`); new module 100.00% lines (120/120), confirmed by reviewer in-session coverage. PowerShell toolchain R1 iteration 1 clean (format with no rewrite, analyze, MCP test 187/187); C# toolchain cycle-0 iteration clean and not invalidated because R1 changed no C#-family file (`evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md`). |
+| AC6 | PASS | `evidence/other/integration-rehearsal.2026-10-09T14-35.md` unchanged. R1 alters only the report label and the `WrittenPath` de-duplication, neither of which changes which files are rewritten or their content; the R1 live-tree `-WhatIf` smoke shows 0 writes and 0 sync repairs on the current tree (`evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md`). |
+| AC7 | PENDING CI | Requires merge, `@dependabot recreate` on PR #984 and observed CI; owned by the item's orchestrator run per `acceptance-criteria-tracking` (CI-dependent criteria). Not a blocking finding. |
+
+## Summary
+
+- Total AC items: 7
+- PASS: 6 (AC1 to AC6)
+- PARTIAL: 0
+- FAIL: 0
+- PENDING CI: 1 (AC7)
+- Review verdict for the branch: PASS. No blocking finding remains; B-1 from review 2026-10-09T14-55 is closed.
+
+### Acceptance Criteria Status
+
+- Source: `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md`
+- Total AC items: 7
+- Checked off (delivered): 6
+- Remaining (unchecked): 1
+- Items remaining: AC7 (pending CI after merge and `@dependabot recreate` on PR #984)
+
+## Acceptance Criteria Check-off
+
+- AC1 to AC6 are already checked off in `spec.md` (lines 193-198); the reviewer's evaluation confirms each as PASS, so no change to the source file was required.
+- AC7 remains unchecked (pending CI), line 199.
+- No criterion text was modified and no new criterion was added.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/issue.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/issue.md
new file mode 100644
index 000000000..541cfc1b0
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/issue.md
@@ -0,0 +1,68 @@
+# dependabot-repair-borrowed-packages-and-transitive-redirects (Issue #985)
+
+- Date captured: 2026-10-09
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/dependabot-repair-borrowed-packages-and-transitive-redirects/ (Issue #985)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #985
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/985
+- Last Updated: 2026-10-09
+- Work Mode: full-bug
+
+## Summary
+
+Grouped NuGet Dependabot pull requests (PR #984) still fail CI after the `dependabot-repair` workflow (issue #911) runs successfully, because two classes of manifest inconsistency are invisible to both Dependabot and the repair script: (1) test projects that hint-path a package they do not declare in their own `packages.config` (borrowed from a sibling production project), and (2) `app.config` binding redirects for assemblies that a project receives only transitively (no `packages.config` entry and no direct `<Reference>`). All failures must be remediated automatically, with no manual step on any future Dependabot PR.
+
+## Environment
+
+- OS/version: GitHub Actions `windows-latest` (CI) and Windows 11 (local)
+- Python version: n/a (PowerShell 7 repair scripts, .NET Framework 4.8.1 / packages.config projects)
+- Command/flags used: CI workflow `ci.yml` on branch `dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9`; repair workflow `.github/workflows/dependabot-repair.yml` (workflow_run trigger) invoking `scripts/dependencies/Repair-PackageManifestConsistency.ps1` without `-CandidateUpgrade`
+- Data source or fixture: PR #984 (AngleSharp, log4net 3.4.0 -> 3.5.0, Microsoft.Web.WebView2 1.0.4191.47 -> 1.0.4258.31, analyzer bumps); CI run #1059 (id 37959420911) on repair commit fff92fe83
+
+## Steps to Reproduce
+
+1. Let Dependabot open a grouped NuGet update that bumps Microsoft.Web.WebView2 and log4net (PR #984).
+2. Let `dependabot-repair` run after CI; it repairs `<Analyzer Include>` paths and pushes commit fff92fe83 as `taskmaster-dependabot-repair[bot]`.
+3. Observe CI run #1059 on that commit.
+
+## Expected Behavior
+
+After the repair workflow runs, every required CI check (build-analyzers, build-nullable, mstest-coverage, pester, format-check, actionlint, hygiene) passes on the Dependabot branch with no human edit. Every project that compiles against a package declares that package in its own `packages.config`, and every `bindingRedirect newVersion` equals an assembly version actually referenced in the solution.
+
+## Actual Behavior
+
+- build-analyzers, build-nullable, mstest-coverage fail: `UtilitiesCS.Test` and `QuickFiler.Test` hint-path `packages\Microsoft.Web.WebView2.1.0.4191.47\...` without declaring WebView2 in their own `packages.config`; after the production projects move to 1.0.4258.31 nothing restores 4191.47, producing `CS0012` / `CS0234` / `CS0246` (for example `UtilitiesCS.Test\HelperClasses\ThemeHelpers\ThemeTests.cs(284,29): error CS0012: The type 'WebView2' is defined in an assembly that is not referenced`).
+- The same latent pattern exists on main for `ObjectListView.Official 2.9.1` in `QuickFiler.Test` and `TaskTree.Test`.
+- pester fails: `BindingRedirectVerification.Tests.ps1` reports `log4net|3.4.0.0` because Tags.Test, TaskTree.Test, TaskVisualization.Test, ToDoModel.Test and VBFunctions.Test keep `newVersion="3.4.0.0"` while every other project moved to 3.5.0.0; those five projects have no log4net `packages.config` entry or `<Reference>`, so neither Dependabot nor the repair script edits them, and the repair's redirect pass does not run from the workflow_run trigger because `-CandidateUpgrade` is not supplied (see `dependabot-repair.yml` lines 87-94).
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or screenshot
+- Snippet: `Expected 0, because every bindingRedirect newVersion must equal a csproj Reference version (issue 973 emptied the recorded known-debt set; a new stale pair is fixed, not recorded); observed: log4net|3.4.0.0, but got 1.`
+
+## Impact / Severity
+
+- [x] Blocker
+- [ ] High
+- [ ] Medium
+- [ ] Low
+
+## Suspected Cause / Notes
+
+Dependabot's packages.config updater and `Repair-PackageManifestConsistency.ps1` both act only on packages a project declares in its own `packages.config`. Borrowed hint paths and transitive binding redirects fall outside that set. The verifier (`ConsistencyVerifier.psm1` `Find-OrphanedHintPath`) already detects borrowed hint paths but is not a failing gate on main.
+
+## Proposed Fix / Validation Ideas
+
+- [ ] Declare Microsoft.Web.WebView2 in QuickFiler.Test and UtilitiesCS.Test `packages.config`, and ObjectListView.Official in QuickFiler.Test and TaskTree.Test `packages.config`, at the versions their production siblings declare.
+- [ ] Add a redirect-sync pass to the repair script that sets every `bindingRedirect newVersion` (and the upper bound of `oldVersion`) to the assembly version referenced elsewhere in the solution, covering transitive redirects; run it from the workflow_run trigger.
+- [ ] Make orphaned (borrowed) hint paths a failing check on main (Pester gate) so the pattern cannot recur.
+- [ ] Pester coverage for the new pass with in-memory fixtures (no temp files).
+- [ ] After merge, `@dependabot recreate` on PR #984 and confirm all required checks pass with no human edit.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md
new file mode 100644
index 000000000..8a03d0589
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md
@@ -0,0 +1,643 @@
+# 2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects (Plan)
+
+- **Issue:** #985
+- **Parent (optional):** none
+- **Owner:** drmoisan
+- **Last Updated:** 2026-10-09
+- **Status:** Draft (planner round 1; preflight round 1 deltas 1-9 and the background-run note applied; awaiting confirming preflight)
+- **Version:** 1.1
+- **Work Mode:** full-bug (AC source: `spec.md` only, per `issue.md` metadata `- Work Mode: full-bug`)
+
+**Fail-closed evidence rule:** Every baseline, final-QA and coverage-comparison artifact named below is required. If any required artifact is missing or carries a placeholder where a number is required, the audit verdict is BLOCKED or INCOMPLETE, never PASS.
+
+**Evidence accounting rule:** Every evidence-producing task names its artifact path. No task is checked off without its artifact on disk.
+
+## 1. Objective
+
+Make every grouped NuGet Dependabot pull request pass CI after the `dependabot-repair` workflow runs, with no human edit, by (a) declaring the four borrowed (project, package) pairs in the owning test projects' `packages.config` and removing the duplicate `Microsoft.Web.WebView2.Core` reference in `QuickFiler.Test/QuickFiler.Test.csproj`, (b) adding an unconditional, solution-wide binding-redirect sync pass (`scripts/dependencies/BindingRedirectSync.psm1`) wired into `scripts/dependencies/Repair-PackageManifestConsistency.ps1`, and (c) adding a main-branch Pester gate that fails when any project hint-paths a package its own manifest does not declare. Requirements: `spec.md` (Acceptance Criteria AC1 to AC7), `issue.md`, `research/research.2026-10-09T14-10.md`.
+
+Out of scope (spec "Scope & Non-Goals"): any file under `.github/workflows/**` (including its README), `ConsistencyVerifier.psm1`, `ProjectConsistency.psm1`, `BindingRedirectVerification.psm1`, production C# source, Dependabot configuration.
+
+## 2. Conventions
+
+**C1. Symbols.**
+- `FEATURE` = `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985`.
+- `WORKTREE` = the executor's worktree root (the checkout of branch `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`). Every repository path in this plan is relative to `WORKTREE`.
+- `SCRATCH` = the directory `$env:LOCALAPPDATA\Temp\claude\<encoded-worktree>\<session-id>\scratchpad` (the caller-supplied session scratchpad, written through the environment variable so no drive-rooted profile path appears in this tracked file). Resolve it once with `pwsh -NoProfile -Command "Join-Path $env:LOCALAPPDATA 'Temp\claude\<encoded-worktree>\<session-id>\scratchpad'"`.
+- `CMDDIR` = `SCRATCH\985-cmd` (helper scripts, outside the repository).
+- `REHEARSAL` = `SCRATCH\rehearsal-985` (the throwaway rehearsal worktree, outside the repository).
+- `FIX-BRANCH` = `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`. `REHEARSAL-BRANCH` = `rehearsal-985-throwaway`. `DEPENDABOT-REF` = `origin/dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9`.
+- `<TS>` = the local timestamp read from the host clock when the task runs: `pwsh -NoProfile -Command "Get-Date -Format yyyy-MM-ddTHH-mm"`. Never composed or estimated.
+
+**C2. Evidence schema.** Every command-step artifact carries, in this order, `Timestamp:`, `Command:`, `EXIT_CODE:`, optional `ExpectedExitCode:` (only on `[expect-fail]` artifacts), and `Output Summary:` (1 to 20 lines carrying the essential result signal, including every gate value the task names). Evidence lives only under `FEATURE/evidence/<kind>/` with kind `baseline`, `regression-testing`, `qa-gates` or `other`. No caller-supplied non-canonical evidence path was received, so no `EVIDENCE_LOCATION_OVERRIDE_REJECTED` record applies.
+
+**C3. Hygiene (tracked-file content).** The repository hygiene guard (`scripts/hygiene/Test-RepositoryHygiene.Rules.ps1` lines 5-55) fails CI on any tracked line matching a drive-letter user-profile path, and lines 57-123 reject a raw JaCoCo document (one carrying `sourcefile`/`class`/`line` elements), a Cobertura document and a trx document. Therefore: (a) evidence text never carries an absolute path; write `WORKSPACE-ROOT` for a worktree root and `USER-PROFILE` for a profile path (every helper script below already performs that substitution on every line it prints); `Command:` fields write `workspace_root = WORKSPACE-ROOT`; (b) raw Pester JaCoCo documents are written only under the ignored `coverage/` directory and never copied into `FEATURE`; (c) the only coverage files copied into `FEATURE` are the MSTest runner's package-level projection (`*.jacoco.xml`) and its trx-derived `*.summary.txt`, which CLAUDE.md "Committed Test Evidence Format" permits.
+
+**C4. CMD-SANITIZE (run before every commit).** With the Grep tool, pattern `(?i)[a-z]:[\\/]+users[\\/]+[a-z0-9_.~-]`, output mode count: (1) path `FEATURE` must return 0; (2) positive control, path `.git` (the worktree's gitdir pointer file, which names a profile path) must return 1. A control of 0 is STOP: SANITIZE-BLIND. A non-zero count in (1) is fixed by replacing the matched path with the C3 token and re-running C4.
+
+**C5. Shell discipline.** Bash permits only `git *` and `pwsh *` segments: never `cd`, use `git -C <dir>` and absolute script paths (`pwsh -NoProfile -File <CMDDIR>\<script>.ps1 ...`); each helper script does its own `Set-Location -LiteralPath`. Repository text searches use the Grep tool; the Grep tool is a regex engine, so the literals `[`, `]`, `.`, `(`, `)` in a counted token are escaped as written in each task.
+
+**C6. Helper scripts.** Phase 0 writes the nine helper scripts of section 5 into `CMDDIR` verbatim (P0-T2 writes `985-probe.ps1`, P0-T3 the other eight) with the Write tool (they are outside the repository, so they are neither committed nor counted by the PowerShell batch budget, whose hook ignores paths outside the repository root). Every helper prints only sanitized lines (C3).
+
+**C7. Loop rules.**
+- PowerShell loop = P4-T1 through P4-T5. If any of those steps fails, or P4-T1 rewrites any file, fix the cause inside the Write Set (section 4) and restart at P4-T1. Each iteration's artifacts carry `ITERATION: <n>`; only a single iteration in which P4-T1 through P4-T5 all pass satisfies Phase 4.
+- C# loop = P5-T1 through P5-T5, same rule, restart at P5-T1. A fix that touches a PowerShell file restarts at P4-T1 and then re-runs Phase 5 from P5-T1.
+- Flaky-test re-measurement (not a retry mechanism): if CMD-MSTEST prints `RUNNER_RESULT=THREW`, `TRX-FAILED-COUNT: 1`, and its single `TRX-FAILED-TEST:` line ends with `TryAddValuesAsync_UpdatesExistingValue` (issue #780; the runner throws at `Invoke-MSTestWithCoverage.ps1` line 262 before writing its summary, so the failed set is read from the trx), run the same command once more and record both runs; the second run governs. Any other failure is a loop failure.
+
+**C8. Stop list.** STOP (record the reason in the task's artifact, leave the task unchecked, report to the caller) on: STOP: PWSH-UNAVAILABLE, STOP: TOOL-MISSING (P0-T2), STOP: BASELINE-FORMAT-DRIFT (P0-T5), STOP: ANALYZE-BASELINE-RED (P0-T6), STOP: BASELINE-TEST-RED (P0-T7, P0-T8, P0-T13), STOP: CS-BASELINE-RED (P0-T9, P0-T10, P0-T11, P0-T12), STOP: WRONG-REASON (P1-T3, P1-T4), STOP: LIVE-TREE-SYNC-NONZERO (P3-T6), STOP: SIZE-LIMIT (P3-T3, P4-T6), STOP: COMMIT-BLOCKED (P6-T1, P8-T2), STOP: SANITIZE-BLIND (C4, P4-T5), and every rehearsal failure in Phase 7 (STOP: REHEARSAL-FAILED, rule R-FAIL in Phase 7). No other condition stops the plan; loop failures follow C7.
+
+**C9. Commit command (CMD-COMMIT).** `git add -- <explicit paths>` (never `-A`, never `.`), then `git commit -m "<subject>" -m "<body>"` followed by the trailer `-m` arguments dictated by the executing session's attribution instructions, then `git rev-parse HEAD` and `git status --porcelain`. The task's own plan checkbox is flipped to `[x]` before `git add`; if `git add` or `git commit` fails or a hook denies it, restore the checkbox to `[ ]` and STOP: COMMIT-BLOCKED. No push is performed by this plan.
+
+**C10. Agent-memory porcelain lines.** Porcelain lines whose path begins `.claude/agent-memory/` are excluded from every `PreExistingWorktreePaths` comparison (P0-T14, P6-T1, P8-T2) and are recorded separately as `AGENT-MEMORY-LINES:`. Agent-memory files ARE committed: P6-T1 and P8-T2 add every path listed on their `AGENT-MEMORY-LINES:` line to the CMD-COMMIT path list (repository policy: commit all audit-trail evidence; the worktree must end clean).
+
+**C11. Long-running commands.** The MSBuild Rebuild runs (P0-T11, P0-T12, P5-T3, P5-T4, P7-T13, P7-T14) and the MSTest coverage runs (P0-T13, P5-T5) can exceed the 10-minute Bash tool limit. The executor runs each of them with `run_in_background` and waits for the background command to complete before reading its output; a run cut off by the tool limit is never treated as a result.
+
+## 3. Planner Decisions
+
+- **D1 (rehearsal fidelity: simulated Dependabot update).** A literal "merge the fix into PR #984's branch, then repair and build" leaves `QuickFiler.Test` and `UtilitiesCS.Test` declaring and referencing `Microsoft.Web.WebView2` 1.0.4191.47 while their production project references compile against the bumped version. That state never occurs after merge: research section 4.1 and spec "Rollout" state that `@dependabot recreate` regenerates the group from main, where the test projects now declare WebView2, so Dependabot bumps them too. The repair script cannot perform that bump: it does not rewrite a `Reference Include` version for an assembly not named for its package (research 3.1, `ProjectConsistency.psm1` `Get-RewrittenReferenceVersionLine`). Phase 7 therefore inserts one step between the merge and the workflow-faithful repair run: for each newly declared (test project, package) pair whose production sibling on the Dependabot branch declares a different version, run the NuGet packages.config updater (`nuget update`) for that pair only. Binding redirects are deliberately left to the repair script's new sync pass, which exercises it on real content. A read-only `-WhatIf` repair run on the merged tree before the simulation (P7-T6) records what the sync pass proposes on the literal merge state. This decision does not change AC6's text; it is flagged to the caller for confirmation.
+- **D2 (rehearsal merge strategy).** The merge uses `-X ours` (the Dependabot side wins any conflicting hunk), because the fix's insertions sit beside lines Dependabot bumps (for example `MSTest.TestFramework` directly above the `ObjectListView.Official` insertion point in `TaskTree.Test/packages.config`). P7-T4 then verifies every fix element by content and re-applies any element the strategy dropped, recording each re-application.
+- **D3 (MSTest route).** `scripts/vscode/Invoke-MSTestWithCoverage.ps1` hard-codes its test filter (lines 82-94) and exposes no filter parameter. Per the caller's authorization and the recorded workstation hang of the shell-icon classes, CMD-MSTEST dot-sources the runner (its entry guard is line 459) and redefines `Get-DotnetCoverageArgumentList` with the runner's own list plus the exclusion `FullyQualifiedName!~HelperClasses.ShellUtilities_Tests`, `FullyQualifiedName!~HelperClasses.ShellUtilitiesStatic_Tests`, `FullyQualifiedName!~HelperClasses.SysImageListHelperTests`, `FullyQualifiedName!~EmailIntelligence.OSBrowser_Tests` and a blame hang collector. The same route is used at baseline and final so the figures are comparable. Every MSTest artifact records `SHELL-ICON-EXCLUSION: APPLIED` and the four class names; CI runs the full set.
+- **D4 (MSBuild route).** `scripts/vscode/Invoke-VSBuild.ps1` runs `Sync-PackageReferences.ps1` before building (lines 247-253), which can rewrite `.csproj` HintPaths and would mask exactly the manifest defects this item fixes. CMD-MSBUILD therefore resolves MSBuild through vswhere and runs the CLAUDE.md argument lists verbatim (`/t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU"` plus the gate properties).
+- **D5 (PowerShell numbers).** The PoshQC MCP tools return only `{ok, tool, workspace_root, summary}` and the MCP test tool's coverage document does not instrument `scripts/dependencies`. Every MCP step is therefore run unconditionally for the policy record and paired with a direct Pester run (CMD-PESTER) whose configuration mirrors `.github/workflows/_pester.yml` lines 40-47, which supplies pass/fail counts and line coverage.
+- **D6 (coverage gates).** PowerShell: aggregate line coverage over `scripts/dependencies`, `scripts/hygiene`, `scripts/vscode` at or above 80.00 (CLAUDE.md UT2 and the `_pester.yml` line 71 floor; the 85 figure in `.claude/rules/quality-tiers.md` is recorded as an observation because CLAUDE.md takes precedence and the two documents disagree); `BindingRedirectSync.psm1` line coverage at or above 90.00 (new-code rule); `Repair-PackageManifestConsistency.ps1` per-file line coverage not lower than its baseline figure (changed-lines no-regression). An aggregate not-lower gate is not used because adding a module covered at 90 to a folder covered above 90 lowers the aggregate without any regression. C#: no C# source line changes (proved by an empty `*.cs` numstat), so the runner's own floors (line 80, branch 75) are the gate and the baseline-to-final delta is recorded.
+- **D7 (AC7).** AC7 is CI-dependent and is checked off by the item's orchestrator after merge (acceptance-criteria-tracking "CI-Dependent Criteria"). This plan records it as pending and never checks it off.
+- **D8 (rehearsal path length).** `REHEARSAL` is a long path; .NET Framework MSBuild can fail on paths over 260 characters. P0-T2 records the resolved length and the `LongPathsEnabled` registry value. A rehearsal build failure whose text names a path-length condition is still a STOP (caller rule), classified `REHEARSAL-ENVIRONMENT-PATH-LENGTH` so the caller can relocate the rehearsal.
+- **D9 (spec premises re-verified).** The four borrowed pairs and their insertion anchors (research 4.1) were re-derived against this tree: see section 9.
+
+## 4. Write Set
+
+Production and manifest files (the only files outside `FEATURE` this plan modifies):
+- `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`, `QuickFiler.Test/QuickFiler.Test.csproj`
+- `scripts/dependencies/BindingRedirectSync.psm1` (new), `scripts/dependencies/Repair-PackageManifestConsistency.ps1`
+
+Test files:
+- `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` (one new `It`)
+- `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (new)
+- `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (new)
+
+Feature folder: this plan (checkboxes), `FEATURE/spec.md` (AC checkbox flips only, AC1 to AC6), and the evidence files named in the tasks. Agent-memory files under `.claude/agent-memory/` that are dirty at commit time are committed by P6-T1 and P8-T2 (C10); they are not code changes. Production PowerShell file count: 2 (direct-mode budget 1-3).
+
+## 5. Helper Script Definitions (written by P0-T3 into CMDDIR)
+
+Every script below starts with the same sanitizer. It is shown once here and is pasted at the top of each script after its `param` block.
+
+```powershell
+function Format-SafeLine {
+    param([string]$Line, [string[]]$Root = @())
+    $text = [string]$Line
+    foreach ($entry in $Root) {
+        if (-not [string]::IsNullOrEmpty($entry)) {
+            $text = [regex]::Replace($text, [regex]::Escape($entry), 'WORKSPACE-ROOT', 'IgnoreCase')
+        }
+    }
+    return [regex]::Replace($text, '[A-Za-z]:[\\/]+[Uu][Ss][Ee][Rr][Ss][\\/]+[^\\/\s"]+', 'USER-PROFILE')
+}
+```
+
+**985-probe.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$RehearsalRoot)
+Set-StrictMode -Version Latest
+"PWSH-VERSION: $($PSVersionTable.PSVersion)"
+$pester = Get-Module -ListAvailable Pester | Sort-Object Version -Descending | Select-Object -First 1
+"PESTER-AVAILABLE: $(if ($pester) { $pester.Version } else { 'NONE' })"
+$nuget = Get-Command nuget -ErrorAction SilentlyContinue
+"NUGET: $(if ($nuget) { 'FOUND' } else { 'NONE' })"
+if ($nuget) { "NUGET-VERSION: $(@(& nuget help) | Select-Object -First 1)" }
+$vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+"VSWHERE: $(Test-Path -LiteralPath $vswhere)"
+if (Test-Path -LiteralPath $vswhere) {
+    $msbuild = & $vswhere -latest -requires Microsoft.Component.MSBuild -find 'MSBuild\**\Bin\MSBuild.exe' | Select-Object -First 1
+    "MSBUILD: $(if ($msbuild) { 'FOUND' } else { 'NONE' })"
+}
+"DOTNET-COVERAGE: $(if (Get-Command dotnet-coverage -ErrorAction SilentlyContinue) { 'FOUND' } else { 'NONE' })"
+$longPath = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name LongPathsEnabled -ErrorAction SilentlyContinue
+"LONG-PATHS-ENABLED: $(if ($longPath) { $longPath.LongPathsEnabled } else { 'UNSET' })"
+"REHEARSAL-ROOT-LENGTH: $($RehearsalRoot.Length)"
+```
+
+**985-restore.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$WorkspaceRoot)
+Set-StrictMode -Version Latest
+Set-Location -LiteralPath $WorkspaceRoot
+$line = @(& nuget restore TaskMaster.sln -NonInteractive 2>&1 | ForEach-Object { [string]$_ })
+$exitCode = $LASTEXITCODE
+"COMMAND: nuget restore TaskMaster.sln -NonInteractive"
+"EXIT_CODE: $exitCode"
+"LINE-COUNT: $($line.Count)"
+foreach ($entry in @($line | Select-Object -Last 5)) { "TAIL: $(Format-SafeLine -Line $entry -Root @($WorkspaceRoot))" }
+exit $exitCode
+```
+
+**985-csharpier.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$WorkspaceRoot, [Parameter(Mandatory = $true)][ValidateSet('restore', 'format', 'check')][string]$Mode)
+Set-StrictMode -Version Latest
+Set-Location -LiteralPath $WorkspaceRoot
+$argument = if ($Mode -eq 'restore') { @('tool', 'restore') } else { @('tool', 'run', 'csharpier', $Mode, '.') }
+$line = @(& dotnet @argument 2>&1 | ForEach-Object { [string]$_ })
+$exitCode = $LASTEXITCODE
+"COMMAND: dotnet $($argument -join ' ')"
+"EXIT_CODE: $exitCode"
+foreach ($entry in @($line | Select-Object -Last 8)) { "TAIL: $(Format-SafeLine -Line $entry -Root @($WorkspaceRoot))" }
+exit $exitCode
+```
+
+**985-msbuild.ps1**
+
+```powershell
+param(
+    [Parameter(Mandatory = $true)][string]$WorkspaceRoot,
+    [Parameter(Mandatory = $true)][ValidateSet('Analyzers', 'Nullable')][string]$Gate,
+    [Parameter(Mandatory = $true)][string]$LogName
+)
+Set-StrictMode -Version Latest
+Set-Location -LiteralPath $WorkspaceRoot
+$vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+$msbuild = & $vswhere -latest -requires Microsoft.Component.MSBuild -find 'MSBuild\**\Bin\MSBuild.exe' | Select-Object -First 1
+if (-not $msbuild) { 'MSBUILD-NOT-FOUND'; exit 2 }
+$gateArgument = if ($Gate -eq 'Analyzers') { @('/p:EnableNETAnalyzers=true', '/p:EnforceCodeStyleInBuild=true') } else { @('/p:TreatWarningsAsErrors=true') }
+$argument = @('TaskMaster.sln', '/t:Rebuild', '/m', '/p:Configuration=Debug', '/p:Platform=Any CPU') + $gateArgument
+"COMMAND: msbuild $($argument -join ' ')"
+$logDirectory = Join-Path $WorkspaceRoot 'coverage'
+New-Item -ItemType Directory -Force -Path $logDirectory | Out-Null
+$logPath = Join-Path $logDirectory $LogName
+& $msbuild @argument 2>&1 | ForEach-Object { [string]$_ } | Set-Content -LiteralPath $logPath -Encoding utf8
+$exitCode = $LASTEXITCODE
+$line = @(Get-Content -LiteralPath $logPath)
+"EXIT_CODE: $exitCode"
+"OUTPUT-ASSEMBLIES: $(@($line | Where-Object { $_ -match ' -> .+\.(dll|exe)\s*$' }).Count)"
+foreach ($summary in @($line | Where-Object { $_ -match '^\s*\d+ (Warning|Error)\(s\)\s*$' })) { "SUMMARY: $($summary.Trim())" }
+$errorLine = @($line | Where-Object { $_ -match ': error [A-Z]+[0-9]+' } | Sort-Object -Unique)
+"ERROR-LINE-COUNT: $($errorLine.Count)"
+foreach ($entry in @($errorLine | Select-Object -First 40)) { "ERROR: $(Format-SafeLine -Line $entry -Root @($WorkspaceRoot))" }
+$pathLength = @($line | Where-Object { $_ -match 'PathTooLong|MSB3491|exceeds the maximum|too long' }).Count
+"PATH-LENGTH-SIGNATURE-LINES: $pathLength"
+exit $exitCode
+```
+
+**985-mstest.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$WorkspaceRoot, [Parameter(Mandatory = $true)][string]$EvidencePrefix)
+Set-StrictMode -Version Latest
+Set-Location -LiteralPath $WorkspaceRoot
+$summaryPath = Join-Path $WorkspaceRoot 'coverage\test-results\mstest-coverage-run.summary.txt'
+$trxPath = Join-Path $WorkspaceRoot 'coverage\test-results\mstest-coverage-run.trx'
+$projectionPath = Join-Path $WorkspaceRoot 'coverage\coverage.cobertura.jacoco.xml'
+foreach ($stale in @($summaryPath, $trxPath, $projectionPath)) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue }
+. (Join-Path $WorkspaceRoot 'scripts\vscode\Invoke-MSTestWithCoverage.ps1')
+function Get-DotnetCoverageArgumentList {
+    param(
+        [Parameter(Mandatory = $true)][string]$OutputPath,
+        [Parameter(Mandatory = $true)][string]$CoverageConfig,
+        [Parameter(Mandatory = $true)][string]$VsTestPath,
+        [Parameter(Mandatory = $true)][string[]]$TestAssembly,
+        [Parameter(Mandatory = $true)][string]$RunSettingsPath,
+        [Parameter(Mandatory = $true)][string]$ResultsDirectory,
+        [Parameter(Mandatory = $true)][string]$LogFileName
+    )
+    $filter = '/TestCaseFilter:TestCategory!=LiveOutlook' +
+    '&FullyQualifiedName!~HelperClasses.ShellUtilities_Tests' +
+    '&FullyQualifiedName!~HelperClasses.ShellUtilitiesStatic_Tests' +
+    '&FullyQualifiedName!~HelperClasses.SysImageListHelperTests' +
+    '&FullyQualifiedName!~EmailIntelligence.OSBrowser_Tests'
+    return @('collect', '--output', $OutputPath, '--output-format', 'cobertura', '--settings', $CoverageConfig, '--', $VsTestPath) +
+    @($TestAssembly) +
+    @("/Settings:$RunSettingsPath", '/InIsolation', $filter, '/Blame:CollectHangDump;TestTimeout=4min;HangDumpType=None',
+        "/ResultsDirectory:$ResultsDirectory", "/Logger:trx;LogFileName=$LogFileName")
+}
+"SHELL-ICON-EXCLUSION: APPLIED ShellUtilities_Tests ShellUtilitiesStatic_Tests SysImageListHelperTests OSBrowser_Tests"
+$status = 'COMPLETED'
+try {
+    Invoke-MSTestWithCoverageMain -ScriptRoot (Join-Path $WorkspaceRoot 'scripts\vscode') |
+        ForEach-Object { Format-SafeLine -Line ([string]$_) -Root @($WorkspaceRoot) }
+}
+catch {
+    $status = 'THREW'
+    "RUNNER-ERROR: $(Format-SafeLine -Line $_.Exception.Message -Root @($WorkspaceRoot))"
+}
+"RUNNER_RESULT=$status"
+if (Test-Path -LiteralPath $summaryPath) {
+    Get-Content -LiteralPath $summaryPath | ForEach-Object { "TRX-SUMMARY: $_" }
+    Copy-Item -LiteralPath $summaryPath -Destination ($EvidencePrefix + '.summary.txt') -Force
+}
+else { 'TRX-SUMMARY-MISSING' }
+if (Test-Path -LiteralPath $projectionPath) {
+    Copy-Item -LiteralPath $projectionPath -Destination ($EvidencePrefix + '.jacoco.xml') -Force
+    'PROJECTION-COPIED'
+}
+else { 'PROJECTION-MISSING' }
+if ($status -eq 'THREW' -and (Test-Path -LiteralPath $trxPath)) {
+    [xml]$trx = Get-Content -LiteralPath $trxPath -Raw
+    $failedName = @($trx.SelectNodes("//*[local-name()='UnitTestResult'][@outcome='Failed']") | ForEach-Object { $_.GetAttribute('testName') } | Sort-Object -Unique)
+    "TRX-FAILED-COUNT: $($failedName.Count)"
+    foreach ($name in $failedName) { "TRX-FAILED-TEST: $name" }
+}
+if ($status -eq 'THREW') { exit 1 }
+exit 0
+```
+
+**985-pester.ps1**
+
+```powershell
+param(
+    [Parameter(Mandatory = $true)][string]$WorkspaceRoot,
+    [Parameter(Mandatory = $true)][string[]]$TestPath,
+    [string[]]$CoveragePath = @(),
+    [string]$CoverageOutput = 'coverage/985-pester-coverage.xml'
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+Set-Location -LiteralPath $WorkspaceRoot
+$testPathList = @($TestPath | ForEach-Object { $_ -split ',' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })
+$coveragePathList = @($CoveragePath | ForEach-Object { $_ -split ',' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })
+"TEST-PATH-COUNT: $($testPathList.Count)"
+"COVERAGE-PATH-COUNT: $($coveragePathList.Count)"
+Import-Module Pester -MinimumVersion 5.6.1
+"PESTER-VERSION: $((Get-Module Pester).Version)"
+$configuration = New-PesterConfiguration
+$configuration.Run.Path = $testPathList
+$configuration.Run.PassThru = $true
+$configuration.Output.Verbosity = 'Normal'
+if ($coveragePathList.Count -gt 0) {
+    New-Item -ItemType Directory -Force -Path (Split-Path -Parent (Join-Path $WorkspaceRoot $CoverageOutput)) | Out-Null
+    $configuration.CodeCoverage.Enabled = $true
+    $configuration.CodeCoverage.Path = $coveragePathList
+    $configuration.CodeCoverage.OutputFormat = 'JaCoCo'
+    $configuration.CodeCoverage.OutputPath = $CoverageOutput
+}
+$result = Invoke-Pester -Configuration $configuration
+"PESTER Passed=$($result.PassedCount) Failed=$($result.FailedCount) Skipped=$($result.SkippedCount) NotRun=$($result.NotRunCount) Total=$($result.TotalCount)"
+foreach ($group in @($result.Tests | Group-Object { [System.IO.Path]::GetFileName([string]$_.ScriptBlock.File) })) {
+    $passed = @($group.Group | Where-Object { $_.Result -eq 'Passed' }).Count
+    $failed = @($group.Group | Where-Object { $_.Result -eq 'Failed' }).Count
+    "FILE-TESTS $($group.Name) Passed=$passed Failed=$failed Total=$($group.Count)"
+}
+foreach ($container in @($result.Containers | Where-Object { $_.Result -ne 'Passed' })) {
+    "CONTAINER-NOT-PASSED $([System.IO.Path]::GetFileName([string]$container.Item)) Result=$($container.Result)"
+}
+foreach ($test in @($result.Failed)) {
+    "FAILED-TEST: $($test.ExpandedPath)"
+    $record = @($test.ErrorRecord) | Select-Object -First 1
+    $message = if ($null -ne $record) { [string]$record.Exception.Message } else { '' }
+    "FAILED-MESSAGE: $(Format-SafeLine -Line (($message -split "`r?`n") -join ' ') -Root @($WorkspaceRoot))"
+}
+if ($coveragePathList.Count -gt 0) {
+    [xml]$jacoco = Get-Content -LiteralPath $CoverageOutput -Raw
+    $lineCounter = @($jacoco.SelectNodes('/report/counter')) | Where-Object { $_.type -eq 'LINE' }
+    $covered = [int]$lineCounter.covered
+    $total = $covered + [int]$lineCounter.missed
+    $percent = if ($total -gt 0) { 100 * $covered / $total } else { 0 }
+    "COVERAGE LinePercent=$($percent.ToString('0.00')) Covered=$covered Total=$total"
+    foreach ($file in @($jacoco.SelectNodes('/report/package/sourcefile'))) {
+        $fileCounter = @($file.SelectNodes('counter')) | Where-Object { $_.type -eq 'LINE' }
+        if ($null -eq $fileCounter) { continue }
+        $fileCovered = [int]$fileCounter.covered
+        $fileTotal = $fileCovered + [int]$fileCounter.missed
+        $filePercent = if ($fileTotal -gt 0) { 100 * $fileCovered / $fileTotal } else { 0 }
+        "FILE-COVERAGE $($file.ParentNode.name)/$($file.name) LinePercent=$($filePercent.ToString('0.00')) Covered=$fileCovered Total=$fileTotal"
+    }
+}
+if ($result.FailedCount -gt 0 -or @($result.Containers | Where-Object { $_.Result -eq 'Failed' }).Count -gt 0) { exit 1 }
+exit 0
+```
+
+**985-junit.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$WorkspaceRoot, [switch]$Clear)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$path = Join-Path $WorkspaceRoot 'artifacts\pester\pester-junit.xml'
+if ($Clear) {
+    Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+    "JUNIT-CLEARED: $(-not (Test-Path -LiteralPath $path))"
+    exit 0
+}
+if (-not (Test-Path -LiteralPath $path)) { 'JUNIT-MISSING'; exit 1 }
+[xml]$junit = Get-Content -LiteralPath $path -Raw
+$root = $junit.DocumentElement
+"JUNIT tests=$($root.GetAttribute('tests')) failures=$($root.GetAttribute('failures')) errors=$($root.GetAttribute('errors')) disabled=$($root.GetAttribute('disabled'))"
+foreach ($suite in @($junit.SelectNodes('//testsuite'))) {
+    "JUNIT-SUITE $([System.IO.Path]::GetFileName($suite.GetAttribute('name'))) tests=$($suite.GetAttribute('tests')) failures=$($suite.GetAttribute('failures'))"
+}
+exit 0
+```
+
+**985-repair.ps1**
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$WorkspaceRoot, [switch]$WhatIfRun)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+Set-Location -LiteralPath $WorkspaceRoot
+$entry = Join-Path $WorkspaceRoot 'scripts\dependencies\Repair-PackageManifestConsistency.ps1'
+"COMMAND: & WORKSPACE-ROOT\scripts\dependencies\Repair-PackageManifestConsistency.ps1$(if ($WhatIfRun) { ' -WhatIf' })"
+$result = if ($WhatIfRun) { & $entry -WhatIf } else { & $entry }
+"IS-SUCCESS: $($result.IsSuccess)"
+"WRITTEN-COUNT: $(@($result.WrittenPath).Count)"
+foreach ($path in @($result.WrittenPath)) { "WRITTEN: $([System.IO.Path]::GetRelativePath($WorkspaceRoot, $path))" }
+"REPAIR-COUNT: $($result.RepairCount)"
+$kind = @($result.Verification | ForEach-Object { $_.Report.Repair } | Where-Object { $null -ne $_ } | ForEach-Object { $_.Kind })
+"BEYOND-KNOWN-WEAK: $(@($kind | Where-Object { $_ -ne 'Analyzer' }).Count)"
+"REPORT-REPAIR-KINDS: $(@($kind | Sort-Object -Unique) -join ',')"
+"SKIP-COUNT: $(@($result.Skipped).Count)"
+"REDIRECTSYNC-REPAIR-COUNT: $(@($result.RedirectSync.Repair).Count)"
+foreach ($record in @($result.RedirectSync.Repair)) {
+    "REDIRECTSYNC: $($record.ProjectDirectory) $($record.AssemblyName) $($record.From) to $($record.To) $($record.Rule)"
+}
+"REDIRECTSYNC-UNVERIFIABLE: $(@($result.RedirectSync.Unverifiable) -join ',')"
+"REDIRECTSYNC-UNRESOLVABLE: $(@($result.RedirectSync.Unresolvable) -join ',')"
+foreach ($failure in @($result.Failure)) { "FAILURE: $($failure.ProjectName): $($failure.Condition)" }
+'BODY-BEGIN'
+foreach ($line in @($result.Body -split "`r?`n")) { Format-SafeLine -Line $line -Root @($WorkspaceRoot) }
+'BODY-END'
+if (-not $result.IsSuccess) { exit 1 }
+exit 0
+```
+
+**985-nuget-update.ps1**
+
+```powershell
+param(
+    [Parameter(Mandatory = $true)][string]$WorkspaceRoot,
+    [Parameter(Mandatory = $true)][string]$ProjectDirectory,
+    [Parameter(Mandatory = $true)][string]$PackageId,
+    [Parameter(Mandatory = $true)][string]$PackageVersion
+)
+Set-StrictMode -Version Latest
+Set-Location -LiteralPath $WorkspaceRoot
+$manifest = Join-Path (Join-Path $WorkspaceRoot $ProjectDirectory) 'packages.config'
+$repository = Join-Path $WorkspaceRoot 'packages'
+$line = @(& nuget update $manifest -Id $PackageId -Version $PackageVersion -RepositoryPath $repository -NonInteractive -FileConflictAction Ignore 2>&1 | ForEach-Object { [string]$_ })
+$exitCode = $LASTEXITCODE
+"COMMAND: nuget update $ProjectDirectory\packages.config -Id $PackageId -Version $PackageVersion -RepositoryPath WORKSPACE-ROOT\packages -NonInteractive -FileConflictAction Ignore"
+"EXIT_CODE: $exitCode"
+foreach ($entry in @($line | Select-Object -Last 8)) { "TAIL: $(Format-SafeLine -Line $entry -Root @($WorkspaceRoot))" }
+exit $exitCode
+```
+
+## 6. Implementation Contracts
+
+### 6.1 `scripts/dependencies/BindingRedirectSync.psm1` (new, ASCII-only, at most 500 lines)
+
+Header comment-based help states: detection lives in `BindingRedirectVerification.psm1`; this module is the writer that keeps every `bindingRedirect` `newVersion` inside the solution-wide csproj `Reference` version map, covering assemblies a project receives only transitively (issue #985). `Set-StrictMode -Version Latest`. Imports, without `-Force` (same reason as `BindingRedirectVerification.psm1` lines 26-29): `PackageGraph.psm1`, `BindingRedirectVerification.psm1`, `ProjectConsistency.psm1`, each via `Join-Path $PSScriptRoot`. `Export-ModuleMember -Function` exactly `Invoke-BindingRedirectSync`, `Invoke-SolutionBindingRedirectSync`, `Format-BindingRedirectSyncReport`.
+
+1. `Invoke-BindingRedirectSync` (`[CmdletBinding()]`, `[OutputType([pscustomobject])]`): parameters `-AppConfigText` (mandatory, `[AllowEmptyString()]`), `-DeployedVersionProvider` (mandatory scriptblock: assembly name in, version strings out), `-PreferredVersionProvider` (optional scriptblock, default `$null`: assembly name in, the project's own Reference versions out). Returns `[pscustomobject]` with `PSTypeName = 'BindingRedirectSync.Result'`, `Text`, `Repair` (array), `Unverifiable` (distinct names, array), `Unresolvable` (distinct names, array), `ExaminedCount`.
+   - Empty or whitespace text: `ExaminedCount` 0, text unchanged, no throw. Otherwise records come from `ConvertFrom-AppConfigText` (which throws for non-configuration text; the exception is not caught).
+   - Each record with a non-empty `NewVersion` increments `ExaminedCount`. A name already handled in this call is skipped.
+   - Deployed set = distinct non-empty strings from the provider. Empty set: add the name to `Unverifiable`, no change.
+   - `NewVersion` in the deployed set (ordinal string comparison, as `Find-StaleBindingRedirect` line 118): no change.
+   - Otherwise target selection: (a) when `PreferredVersionProvider` is supplied and returns exactly one distinct non-empty version and that version is in the deployed set, target = that version, `Rule = 'OwnReference'`; (b) otherwise, if every deployed version parses with `[System.Version]::TryParse`, target = the maximum by `[System.Version]` comparison, `Rule = 'HighestDeployed'`; (c) otherwise add the name to `Unresolvable`, no change.
+   - Apply with `Invoke-BindingRedirectReconciliation -AppConfigText <current text> -AssemblyName <name> -AssemblyVersion <target>` and continue with its `.Text`. Add one repair record: `PSTypeName = 'BindingRedirectSync.Repair'`, `Kind = 'BindingRedirectSync'`, `AssemblyName`, `From` (the original `NewVersion`), `To` (target), `Rule`.
+2. `Invoke-SolutionBindingRedirectSync` (`[CmdletBinding(SupportsShouldProcess = $true)]`): parameters `-DirectoryLister`, `-TextReader`, `-TextWriter` (mandatory scriptblocks, same contracts as `Invoke-ManifestNormalization`, `PackageGraph.psm1` lines 405-418) and `-ProjectTextOverride` (hashtable, default empty; key = csproj path, value = post-repair text).
+   - Project paths = lister output whose extension is `.csproj` (ordinal case-insensitive) and that has no `packages`, `bin`, `obj` or `node_modules` parent segment (same exclusion as `Get-PackageManifestPath`, lines 112-124), sorted. Project text = override value when the override contains the path, else reader output.
+   - Map = `ConvertTo-ReferenceVersionMap -ProjectText <all project texts>`. Deployed provider = map lookup (empty when absent).
+   - For every path from `Get-PackageManifestPath -Kind AppConfig -DirectoryLister`: preferred provider = `ConvertTo-ReferenceVersionMap` over the project text(s) in the same directory (empty provider when none); call function 1; when the returned text differs (`-cne`) and `$PSCmdlet.ShouldProcess(<path>, 'Synchronise binding redirects')`, call the writer and add the path to `ChangedPath`. Each repair record gains `Path` (the app.config path) and `ProjectDirectory` (`Split-Path -Leaf (Split-Path -Parent <path>)`).
+   - Emits exactly one `Write-Information` line with `-InformationAction Continue`: `Binding redirect sync: examined <n> application configuration file(s), synchronised <m> redirect(s), unverifiable <u>, unresolvable <r>`.
+   - Returns `PSTypeName = 'BindingRedirectSync.SolutionResult'`, `ChangedPath`, `Repair`, `Unverifiable` (distinct, sorted), `Unresolvable` (distinct, sorted), `ExaminedAppConfig`.
+3. `Format-BindingRedirectSyncReport`: parameter `-Repair` (mandatory, `[AllowEmptyCollection()]`, `[object[]]`). Empty input returns `''`. Otherwise returns the lines `## Binding redirects synchronised` then one line per record `- <ProjectDirectory>: <AssemblyName> <From> to <To> (<Rule>)`, joined with `[System.Environment]::NewLine`.
+
+Parameters referenced only inside nested scriptblocks are bound to locals first (the pattern at `ProjectConsistency.psm1` lines 323-326) so PSReviewUnusedParameter stays clean.
+
+### 6.2 `scripts/dependencies/Repair-PackageManifestConsistency.ps1` wiring (wiring only; final length at most 500 lines)
+
+1. After the `ConsistencyVerifier.psm1` import (line 71): `Import-Module (Join-Path $PSScriptRoot 'BindingRedirectSync.psm1')` (no `-Force`).
+2. After `$written = ...` (line 382): `$projectTextOverride = @{}`.
+3. Inside the manifest loop, immediately after the block that writes the repaired project (lines 413-417): `$projectTextOverride[$project[0]] = $repaired.Text`.
+4. After the loop's closing brace (line 441) and before the normalisation comment (line 443): a two-line comment stating that the sync runs on every invocation (with or without `-CandidateUpgrade`) and before normalisation so normalisation stays the last writer, and that `-WhatIf` is passed explicitly for the module-preference reason given at lines 443-444; then `$redirectSync = Invoke-SolutionBindingRedirectSync -DirectoryLister $lister -TextReader $reader -TextWriter $writer -ProjectTextOverride $projectTextOverride -WhatIf:$WhatIfPreference` and `foreach ($path in @($redirectSync.ChangedPath)) { $written.Add($path) }`.
+5. Result object: add `RedirectSync = [pscustomobject]@{ Repair = @($redirectSync.Repair); Unverifiable = @($redirectSync.Unverifiable); Unresolvable = @($redirectSync.Unresolvable) }`. `Body`: the existing `& $script:ReportBody ...` text, followed, only when `Format-BindingRedirectSyncReport -Repair @($redirectSync.Repair)` is non-empty, by `[System.Environment]::NewLine` twice and that block. `IsSuccess` and `Verification` are unchanged; no sync record enters `Verification[].Report.Repair`.
+6. Update the `.DESCRIPTION` help sentence listing the passes so it names the binding-redirect sync pass after binding-redirect reconciliation, if the line budget allows; the 500-line ceiling takes precedence.
+
+### 6.3 Test files
+
+`tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (new). Top: `Set-StrictMode -Version Latest`; `BeforeAll` sets `$script:RepoRoot` and `$script:EntryPoint` exactly as `Repair-PackageManifestConsistency.Tests.ps1` lines 4-5 and defines a local `Get-RepairFixture` with the same body as that file's lines 86-120. No block or test name matches the regex `AC` followed by a digit. Fixture store (all in memory; CRLF normalisation exactly as that file's lines 59-61: manifests `-replace "`r?`n", "`r`n"` plus a trailing `"`r`n"`, project and app.config texts `-replace` only):
+- `X:\fixture\Prod\packages.config`: `log4net` version `3.5.0`, `targetFramework="net481"`.
+- `X:\fixture\Prod\Prod.csproj`: `<Reference Include="log4net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=669e0ddf0bb1aa2a, processorArchitecture=MSIL">` with HintPath `..\packages\log4net.3.5.0\lib\net462\log4net.dll`.
+- `X:\fixture\Test\packages.config`: `Fabrikam.Core` version `1.0.0`.
+- `X:\fixture\Test\Test.csproj`: Reference `Fabrikam.Core, Version=1.0.0.0` with HintPath `..\packages\Fabrikam.Core.1.0.0\lib\net472\Fabrikam.Core.dll` (no log4net reference).
+- `X:\fixture\Test\app.config`: two `dependentAssembly` blocks: `log4net` (`publicKeyToken="669e0ddf0bb1aa2a"`) `oldVersion="0.0.0.0-3.4.0.0" newVersion="3.4.0.0"`; `Fabrikam.Core` `oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0"`.
+- Identity map: `log4net|3.5.0` to `net462`/`3.5.0.0`; `Fabrikam.Core|1.0.0` to `net472`/`1.0.0.0`. Asset and listing maps empty.
+
+`Describe 'Repair-PackageManifestConsistency redirect synchronisation (issue 985)'`:
+- `Context 'A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied'`; its `BeforeAll` runs the entry point twice over one store without `-CandidateUpgrade`, keeping both results; it reads no `RedirectSync` property. Tests:
+  - R1 `It 'rewrites the transitive redirect in both positions'`: the Test app.config matches `oldVersion="0\.0\.0\.0-3\.5\.0\.0"` and `newVersion="3\.5\.0\.0"` and still matches the Fabrikam `newVersion="1\.0\.0\.0"`.
+  - R2 `It 'reports the rewritten application configuration in the written paths'`: first-run `WrittenPath` contains `X:\fixture\Test\app.config`.
+  - R3 `It 'carries the synchronised-redirect block in the body'`: first-run `Body` matches `## Binding redirects synchronised` and `log4net 3\.4\.0\.0 to 3\.5\.0\.0`.
+  - R4 `It 'exposes the synchronisation in the RedirectSync field and not in the per-project repair records'`: `@($result.RedirectSync.Repair).Count` is 1 with `AssemblyName` `log4net`, `From` `3.4.0.0`, `To` `3.5.0.0`, `Rule` `HighestDeployed`; the `Kind` values across `Verification[].Report.Repair` do not contain `BindingRedirectSync`.
+  - R5 `It 'writes nothing on a second run over the repaired store'`: second-run `WrittenPath` count 0.
+- `Context 'The same tree run with -WhatIf'`:
+  - R6 `It 'leaves the stale redirect unchanged and writes nothing'`: fresh fixture, `-WhatIf`; store app.config still matches `newVersion="3\.4\.0\.0"`; `WrittenPath` count 0.
+
+`tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (new; imports the module with `-Force` from `$script:RepoRoot`; every fixture in memory; CRLF fixtures built with `-replace "`r?`n", "`r`n"`):
+- `Describe 'Invoke-BindingRedirectSync (in-memory fixtures)'`: S1 `'rewrites a stale redirect in both positions and keeps the oldVersion lower bound'` (lower bound `1.0.0.0` kept); S2 `'replaces a single-version oldVersion outright'`; S3 `'leaves a redirect whose newVersion is already deployed unchanged and reports no repair on a second pass'`; S4 `'reports an assembly with no deployed version as unverifiable and leaves it unchanged'`; S5 `'prefers the project own reference version when several versions are deployed'` (deployed `3.4.0.0`,`3.5.0.0`, preferred `3.4.0.0`, stale `3.3.0.0`, Rule `OwnReference`); S6 `'selects the highest deployed version by numeric comparison when no own reference exists'` (deployed `3.9.0.0`,`3.10.0.0`, target `3.10.0.0`); S7 `'falls back to the highest deployed version when the own reference names more than one version'`; S8 `'reports an unparsable deployed version as unresolvable and leaves the redirect unchanged'`; S9 `'skips a dependentAssembly block that carries no bindingRedirect'`; S10 `'examines zero entries and changes nothing for empty text'`; S11 `'throws when the text is not an application configuration document'`; S12 `'keeps every byte outside the substituted attribute values identical in CRLF text'` (replacing the two new values by the old ones yields text `-ceq` the input).
+- `Describe 'Invoke-SolutionBindingRedirectSync (in-memory store)'` (hashtable store, lister returns the keys): S13 `'synchronises the transitive redirect of a project that does not reference the assembly'`; S14 `'prefers the project text override over the text the reader returns'` (reader csproj says `3.5.0.0`, override says `3.6.0.0`, target `3.6.0.0`); S15 `'writes nothing when run with -WhatIf'`; S16 `'reports exactly the changed application configuration paths'` (`ChangedPath` equals the single Test app.config path; an already-current Prod app.config is absent).
+- `Describe 'Format-BindingRedirectSyncReport'`: S17 `'returns an empty string when there are no repairs'`; S18 `'returns the heading and one line per repair'` (two records give three lines).
+
+`tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`: one new `It` appended inside `Describe 'Repository tree consistency (issue 929)'` after the existing Import `It` (which ends at line 90):
+
+```powershell
+    It 'reports no HintPath whose package folder the sibling manifest does not declare, for every project directory that carries a manifest' {
+        # Arrange: the pair discovery of the Import gate above, so both gates read one population.
+        $pair = @(Get-ChildItem -LiteralPath $script:RepoRoot -Directory | ForEach-Object {
+                $manifest = Join-Path $_.FullName 'packages.config'
+                $project = @(Get-ChildItem -LiteralPath $_.FullName -File | Where-Object { $_.Extension -eq '.csproj' })
+                if ((Test-Path -LiteralPath $manifest) -and $project.Count -eq 1) {
+                    [pscustomobject]@{ Project = $project[0].FullName; Manifest = $manifest }
+                }
+            })
+
+        # Act
+        $examined = 0
+        $finding = [System.Collections.Generic.List[string]]::new()
+        foreach ($entry in $pair) {
+            $detection = Find-OrphanedHintPath -ProjectText ([System.IO.File]::ReadAllText($entry.Project)) -ManifestText ([System.IO.File]::ReadAllText($entry.Manifest))
+            $examined += $detection.ExaminedCount
+            foreach ($item in @($detection.Finding)) {
+                $finding.Add(('{0}: line {1} {2}' -f (Split-Path -Leaf $entry.Project), $item.LineNumber, $item.PackageFolder))
+            }
+        }
+
+        # Assert: the examined count guards the zero finding count.
+        $examined | Should -BeGreaterThan 0 -Because 'a zero examined count would mean the detector never fired'
+        $finding.Count | Should -Be 0 -Because ('these HintPath elements name a package folder the sibling manifest does not declare: ' + ($finding -join '; '))
+    }
+```
+
+## 7. Phases
+
+### Phase 0 — Policy Reads and Baselines
+
+- [x] [P0-T1] Read, in this order, `CLAUDE.md`, `.claude/rules/general-code-change.md`, `.claude/rules/general-unit-test.md`, `.claude/rules/quality-tiers.md`, `.claude/rules/powershell.md`, `.claude/rules/csharp.md`, `.claude/rules/tonality.md`, `.claude/rules/plan-acceptance-gates.md`, `.claude/skills/atomic-plan-contract/SKILL.md`, `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`, `.claude/skills/acceptance-criteria-tracking/SKILL.md`, then `FEATURE/issue.md`, `FEATURE/spec.md`, `FEATURE/research/research.2026-10-09T14-10.md`; write `FEATURE/evidence/baseline/phase0-instructions-read.md` with `Timestamp:`, `Policy Order:` (the order above) and `Files Read:` listing all fourteen paths. Acceptance: the artifact exists with the three fields and fourteen listed paths. Evidence: `FEATURE/evidence/baseline/phase0-instructions-read.md`.
+- [x] [P0-T2] Record git state and tool availability in `FEATURE/evidence/baseline/git-and-tools.<TS>.md`: run `git rev-parse --abbrev-ref HEAD` (must print `FIX-BRANCH`), `git rev-parse HEAD`, `git merge-base HEAD origin/main` (record as `BASE-SHA:`), `git diff --name-only BASE-SHA HEAD` (record; every listed path must lie under `FEATURE`, `.claude/agent-memory/` or `docs/features/potential/`), and `git status --porcelain` (record every line verbatim as `PreExistingWorktreePaths:`); then write `CMDDIR\985-probe.ps1` (section 5) and run `pwsh -NoProfile -File <CMDDIR>\985-probe.ps1 -RehearsalRoot <REHEARSAL>`. Acceptance: `PESTER-AVAILABLE` is 5.6.1 or later, `NUGET: FOUND`, `VSWHERE: True`, `MSBUILD: FOUND`, `DOTNET-COVERAGE: FOUND`; `LONG-PATHS-ENABLED` and `REHEARSAL-ROOT-LENGTH` recorded. A missing tool is STOP: TOOL-MISSING; a refused `pwsh` is STOP: PWSH-UNAVAILABLE. Evidence: `FEATURE/evidence/baseline/git-and-tools.2026-10-09T14-04.md`.
+- [x] [P0-T3] Write the remaining eight helper scripts of section 5 (`985-restore.ps1`, `985-csharpier.ps1`, `985-msbuild.ps1`, `985-mstest.ps1`, `985-pester.ps1`, `985-junit.ps1`, `985-repair.ps1`, `985-nuget-update.ps1`) into `CMDDIR` verbatim, each with the `Format-SafeLine` function pasted after its `param` block, and record the nine file names plus `git hash-object --no-filters` of each in `FEATURE/evidence/baseline/helper-scripts.<TS>.md`. Acceptance: nine names and nine hashes recorded; the hashes are re-checked unchanged by P8-T1. Evidence: `FEATURE/evidence/baseline/helper-scripts.2026-10-09T14-04.md`.
+- [x] [P0-T4] Record pre-change tree facts in `FEATURE/evidence/baseline/tree-facts.<TS>.md` with the Grep tool: line counts (pattern `^`, count) of `QuickFiler.Test/packages.config` (74), `UtilitiesCS.Test/packages.config` (110), `TaskTree.Test/packages.config` (69), `QuickFiler.Test/QuickFiler.Test.csproj` (572), `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (475), `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` (152); carriage-return counts (pattern `\r$`) of the three manifests (73, 109, 68); count of `id="Microsoft\.Web\.WebView2"|id="ObjectListView\.Official"` in the three test manifests (QuickFiler.Test 0, UtilitiesCS.Test 1 — the declared ObjectListView.Official at line 70 —, TaskTree.Test 0); count of `Include="Microsoft\.Web\.WebView2\.Core,` in the csproj (2); and the absence of `scripts/dependencies/BindingRedirectSync.psm1`, `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` and `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (Glob returns none). Acceptance: every observed value equals the parenthesised value; any difference is recorded and reported, and the affected task anchors in Phases 1-3 are re-derived before continuing. Evidence: `FEATURE/evidence/baseline/tree-facts.2026-10-09T14-04.md`.
+- [x] [P0-T5] PowerShell baseline format: record `git status --porcelain` and `git hash-object --no-filters` of `scripts/dependencies/Repair-PackageManifestConsistency.ps1` and `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`, call `mcp__drm-copilot__run_poshqc_format` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`, then repeat both observations; write `FEATURE/evidence/baseline/ps-format.<TS>.md` (`EXIT_CODE:` 0 when `ok` is true, else 1; the MCP `summary` verbatim). Acceptance (success-case observation, not the exit code): porcelain identical before and after and both hashes identical; a rewrite is STOP: BASELINE-FORMAT-DRIFT (revert with `git checkout -- <file>` first). Evidence: `FEATURE/evidence/baseline/ps-format.2026-10-09T14-04.md`.
+- [x] [P0-T6] PowerShell baseline lint: call `mcp__drm-copilot__run_poshqc_analyze` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`; write `FEATURE/evidence/baseline/ps-analyze.<TS>.md` (`EXIT_CODE:` 0 when `ok` is true, else 1). Acceptance: `ok` true; false is STOP: ANALYZE-BASELINE-RED. Type checking does not apply to PowerShell (`.claude/rules/powershell.md` toolchain step 3); the artifact states so. Evidence: `FEATURE/evidence/baseline/ps-analyze.2026-10-09T14-04.md`.
+- [x] [P0-T7] PowerShell baseline MCP test: run `pwsh -NoProfile -File <CMDDIR>\985-junit.ps1 -WorkspaceRoot <WORKTREE> -Clear`, call `mcp__drm-copilot__run_poshqc_test` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [tests/scripts/dependencies]`, then run `985-junit.ps1` without `-Clear`; write `FEATURE/evidence/baseline/ps-test-mcp.<TS>.md` with the `ok` flag and the `JUNIT` and `JUNIT-SUITE` lines (`EXIT_CODE:` 1 when failures plus errors is above 0, else 0). Acceptance: `JUNIT-CLEARED: True`, a `JUNIT` line present, failures 0 and errors 0; otherwise STOP: BASELINE-TEST-RED. Evidence: `FEATURE/evidence/baseline/ps-test-mcp.2026-10-09T14-04.md`.
+- [x] [P0-T8] PowerShell baseline direct coverage (CI mirror, `.github/workflows/_pester.yml` lines 41 and 45): run `pwsh -NoProfile -File <CMDDIR>\985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985-pester-baseline.xml`; write `FEATURE/evidence/baseline/ps-coverage.<TS>.md` carrying the `PESTER`, `COVERAGE` and every `FILE-TESTS` line and the `FILE-COVERAGE` line ending `/Repair-PackageManifestConsistency.ps1`. Acceptance: `TEST-PATH-COUNT: 3` and `COVERAGE-PATH-COUNT: 3`; `Failed=0` (otherwise STOP: BASELINE-TEST-RED); `BASELINE-PS-AGGREGATE:` and `BASELINE-REPAIR-SCRIPT-LINE:` recorded as numbers; the raw document stays under the ignored `coverage/` directory. Evidence: `FEATURE/evidence/baseline/ps-coverage.2026-10-09T14-04.md`.
+- [x] [P0-T9] C# baseline format: first run `pwsh -NoProfile -File <WORKTREE>\scripts\vscode\Install-RepoDotNetSdk.ps1` (installs the `global.json` SDK into `.dotnet-sdk/`, ignored by the `.gitignore` rule `.dotnet*/`; without it csharpier exits -2147450725 with the global.json message) and record its exit code as `SDK-INSTALL-EXIT_CODE:`; only when it is 0, run `pwsh -NoProfile -File <CMDDIR>\985-csharpier.ps1 -WorkspaceRoot <WORKTREE> -Mode restore`, then `-Mode check` (read-only, so no rewrite occurs at baseline); write `FEATURE/evidence/baseline/cs-format.<TS>.md`. Acceptance: SDK install, restore and check all `EXIT_CODE: 0`; a non-zero SDK install or check is STOP: CS-BASELINE-RED (the check never modifies `QuickFiler.Test/packages.config` or any manifest, which `.csharpierignore` lines 15-18 exclude). Evidence: `FEATURE/evidence/baseline/cs-format.2026-10-09T14-04.md`.
+- [x] [P0-T10] C# baseline restore: run `pwsh -NoProfile -File <CMDDIR>\985-restore.ps1 -WorkspaceRoot <WORKTREE>` (restores `TaskMaster.sln` into `packages/`); write `FEATURE/evidence/baseline/cs-restore.<TS>.md`. Acceptance: `EXIT_CODE: 0`; otherwise STOP: CS-BASELINE-RED. Evidence: `FEATURE/evidence/baseline/cs-restore.2026-10-09T14-04.md`.
+- [x] [P0-T11] C# baseline analyzers: run `pwsh -NoProfile -File <CMDDIR>\985-msbuild.ps1 -WorkspaceRoot <WORKTREE> -Gate Analyzers -LogName 985-baseline-analyzers.log` (log under ignored `coverage/`); write `FEATURE/evidence/baseline/cs-analyzers.<TS>.md`. Acceptance: `EXIT_CODE: 0`, a `SUMMARY: 0 Error(s)` line, `OUTPUT-ASSEMBLIES:` recorded as `BASELINE-OUTPUT-ASSEMBLIES:`; otherwise STOP: CS-BASELINE-RED. Evidence: `FEATURE/evidence/baseline/cs-analyzers.2026-10-09T14-04.md`.
+- [x] [P0-T12] C# baseline type-check: run `985-msbuild.ps1 -WorkspaceRoot <WORKTREE> -Gate Nullable -LogName 985-baseline-nullable.log` from `CMDDIR`; write `FEATURE/evidence/baseline/cs-nullable.<TS>.md`. Acceptance: `EXIT_CODE: 0`, `SUMMARY: 0 Error(s)`, `OUTPUT-ASSEMBLIES:` equal to P0-T11's; otherwise STOP: CS-BASELINE-RED. Evidence: `FEATURE/evidence/baseline/cs-nullable.2026-10-09T14-04.md`.
+- [x] [P0-T13] C# baseline tests with coverage (route D3): run `pwsh -NoProfile -File <CMDDIR>\985-mstest.ps1 -WorkspaceRoot <WORKTREE> -EvidencePrefix <WORKTREE>\FEATURE\evidence\baseline\mstest-coverage-baseline.<TS>`; write `FEATURE/evidence/baseline/cs-test.<TS>.md` with `SHELL-ICON-EXCLUSION`, the `Discovered ... test assemblies` line, the `First-party coverage:` line, `RUNNER_RESULT` and every `TRX-SUMMARY` line; the script copies `mstest-coverage-baseline.<TS>.summary.txt` and `mstest-coverage-baseline.<TS>.jacoco.xml` beside it. Acceptance: `RUNNER_RESULT=COMPLETED` (after the C7 flaky rule, if it applies), `TRX-SUMMARY: Failed tests: none`, both copies present, `BASELINE-CS-LINE:` and `BASELINE-CS-BRANCH:` recorded as numbers; otherwise STOP: BASELINE-TEST-RED. Evidence: `FEATURE/evidence/baseline/cs-test.2026-10-09T14-11.md`.
+- [x] [P0-T14] Baseline side-effect check for `QuickFiler.Test/QuickFiler.Test.csproj` and every other tracked file: run `git status --porcelain`; write `FEATURE/evidence/baseline/post-baseline-porcelain.<TS>.md`. Acceptance: excluding `.claude/agent-memory/` lines (recorded as `AGENT-MEMORY-LINES:`, C10), every line is either in `PreExistingWorktreePaths` or under `FEATURE/evidence/`; a modified tracked file (for example a csproj rewritten by a build step) is recorded, reverted with `git checkout -- <file>`, and reported. Evidence: `FEATURE/evidence/baseline/post-baseline-porcelain.2026-10-09T14-13.md`.
+
+### Phase 1 — Regression Tests First
+
+- [x] [P1-T1] Append the new `It` of section 6.3 to `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` inside the existing `Describe`, after the Import `It` that ends at line 90, with the Edit tool (CRLF preserved). Acceptance: Grep count of `It 'reports no HintPath whose package folder the sibling manifest does not declare` is 1, of `Find-OrphanedHintPath -ProjectText` is 1, and of `AC[0-9]` in the file's `Describe`/`Context`/`It` lines is 0. Evidence: Grep counts 1, 1, 0 observed; file 178 lines, 178 CRLF (verified at execution; recorded in `FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.<TS>.md`).
+- [x] [P1-T2] Create `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` per section 6.3 (six `It` blocks R1 to R6, in-memory store only). Acceptance: Grep count of `^\s+It '` is 6; Grep count of `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` is 0; Grep count of `RedirectSync` inside the `BeforeAll` blocks is 0 (read the file to confirm). Evidence: Grep counts 6, 0, 0 observed (RedirectSync only at lines 161-170, inside an `It`); recorded in `FEATURE/evidence/regression-testing/fail-before-redirect-sync.<TS>.md`.
+- [x] [P1-T3] [expect-fail] Run `pwsh -NoProfile -File <CMDDIR>\985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`; write `FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.<TS>.md` with `ExpectedExitCode: 1` and the findings list copied from `FAILED-MESSAGE`. Acceptance (right reason): `EXIT_CODE: 1`; `PESTER ... Failed=1 ... Total=5`; the single `FAILED-TEST:` names the new `It`; its `FAILED-MESSAGE:` contains each of `QuickFiler.Test.csproj: line`, `UtilitiesCS.Test.csproj: line` and `TaskTree.Test.csproj: line`. Any other failure shape is STOP: WRONG-REASON. The finding count is recorded (research predicts 7) but not gated. Evidence: `FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md`.
+- [x] [P1-T4] [expect-fail] Run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/fail-before-redirect-sync.<TS>.md` with `ExpectedExitCode: 1`. Acceptance (right reason): `EXIT_CODE: 1`; `Failed=4 ... Total=6`; the failed set is exactly R1, R2, R3, R4 (names as in section 6.3); R1's `FAILED-MESSAGE:` contains `newVersion`; R5 and R6 passed. Any other shape is STOP: WRONG-REASON. Evidence: `FEATURE/evidence/regression-testing/fail-before-redirect-sync.2026-10-09T14-15.md`.
+
+### Phase 2 — Manifest Declarations
+
+- [x] [P2-T1] In `QuickFiler.Test/packages.config`, insert `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` as a new line between the `Microsoft.TestPlatform.ObjectModel` line (41) and the `Moq` line (42) with the Edit tool. Acceptance: Grep `id="Microsoft\.Web\.WebView2" version="1\.0\.4191\.47" targetFramework="net481"` count 1 at line 42. Evidence: Grep observed count 1 at line 42; recorded in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`.
+- [x] [P2-T2] In `QuickFiler.Test/packages.config`, insert `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` between the `MSTest.TestFramework` line and the `OpenTelemetry` line (46 and 47 after P2-T1). Acceptance: Grep `id="ObjectListView\.Official" version="2\.9\.1" targetFramework="net481"` count 1 at line 47; file line count 76. Evidence: Grep observed count 1 at line 47, 76 lines; recorded in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`.
+- [x] [P2-T3] In `UtilitiesCS.Test/packages.config`, insert the WebView2 line of P2-T1 between the `Microsoft.TestPlatform.ObjectModel` line (63) and the `Mono.Reflection` line (64). Acceptance: Grep count 1 at line 64; file line count 111. Evidence: Grep observed count 1 at line 64, 111 lines; recorded in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`.
+- [x] [P2-T4] In `TaskTree.Test/packages.config`, insert the ObjectListView line of P2-T2 between the `MSTest.TestFramework` line (40) and the `OpenTelemetry` line (41). Acceptance: Grep count 1 at line 41; file line count 70. Evidence: Grep observed count 1 at line 41, 70 lines; recorded in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`.
+- [x] [P2-T5] In `QuickFiler.Test/QuickFiler.Test.csproj`, delete the second WebView2 item group: the five lines 528-532 (`  <ItemGroup>`, the `<Reference Include="Microsoft.Web.WebView2.Core, Version=1.0.4191.47, ...">` line, its `<HintPath>` line, `    </Reference>`, `  </ItemGroup>`), leaving the `ProjectReference` group closing at line 527 directly followed by the `Analyzer` item group. Acceptance: Grep count of `Include="Microsoft\.Web\.WebView2\.Core,` is 1 (line 388); file line count 567; Grep count of `Microsoft\.Web\.WebView2\.1\.0\.4191\.47` is 2 (lines 389 and 392). Evidence: observed Include count 1 (line 388), 567 lines, folder count 2 (lines 389, 392); recorded in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`.
+- [x] [P2-T6] Record manifest-edit facts in `FEATURE/evidence/other/manifest-edit-facts.<TS>.md`: for `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config` the line counts (76, 111, 70) and carriage-return counts (75, 110, 69, so every inserted line kept CRLF), the inserted lines, and the production sibling declarations they match (`QuickFiler/packages.config` lines 19 and 22, `UtilitiesCS/packages.config` line 57, `TaskTree/packages.config` line 8, each re-read in this task); `git diff --numstat BASE-SHA -- QuickFiler.Test/packages.config UtilitiesCS.Test/packages.config TaskTree.Test/packages.config QuickFiler.Test/QuickFiler.Test.csproj` (expected `2 0`, `1 0`, `1 0`, `0 5`) and `git status --porcelain` over the same four paths. Acceptance: every value equals the expectation. Evidence: `FEATURE/evidence/other/manifest-edit-facts.2026-10-09T14-17.md`.
+- [x] [P2-T7] Run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/pass-after-orphaned-hintpath.<TS>.md`. Acceptance: `EXIT_CODE: 0`, `Passed=5 Failed=0`, no `FAILED-TEST:` line. Evidence: `FEATURE/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md`.
+- [x] [P2-T8] Check off AC1 in `FEATURE/spec.md` (change only `- [ ] AC1` to `- [x] AC1`), citing P2-T6 and P2-T7. Acceptance: Grep `^- \[x\] AC1 ` count 1 and `^- \[ \] AC1 ` count 0. Evidence: spec.md line 193 `- [x] AC1`; cites `FEATURE/evidence/other/manifest-edit-facts.2026-10-09T14-17.md` and `FEATURE/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md`.
+- [x] [P2-T9] Check off AC3 in `FEATURE/spec.md`, citing P1-T1, P1-T3 and P2-T7 (fail-first and passing runs under `FEATURE/evidence/regression-testing/`). Acceptance: Grep `^- \[x\] AC3 ` count 1. Evidence: spec.md `- [x] AC3`; cites `FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.2026-10-09T14-15.md` and `FEATURE/evidence/regression-testing/pass-after-orphaned-hintpath.2026-10-09T14-17.md`.
+
+### Phase 3 — Redirect Sync Module and Wiring
+
+- [x] [P3-T1] Create `scripts/dependencies/BindingRedirectSync.psm1` per section 6.1 (ASCII only). Acceptance: Grep `^Export-ModuleMember` count 1 and each of the three function names appears once in a `function` line; Grep `Import-Module .*-Force` count 0; Grep `[^\x00-\x7F]` count 0. Evidence: observed Export-ModuleMember 1 (line 303), function lines 75/170/276, `-Force` import 0, non-ASCII 0; recorded in `FEATURE/evidence/other/line-counts-post-impl.<TS>.md`.
+- [x] [P3-T2] Wire `scripts/dependencies/Repair-PackageManifestConsistency.ps1` per section 6.2 with the Edit tool (CRLF preserved). Acceptance: Grep counts in that file: `BindingRedirectSync\.psm1` 1, `Invoke-SolutionBindingRedirectSync` 1, `-WhatIf:\$WhatIfPreference` 2, `RedirectSync\s+=` 1, `Format-BindingRedirectSyncReport` 1, `\$projectTextOverride\[` 1; `-CandidateUpgrade` gating absent from the new call (read the inserted block). Evidence: observed counts 1, 1, 2, 1, 1, 1 (lines 73, 449-450, 456, 487, 464, 421); the call at lines 449-450 sits after the loop with no `-CandidateUpgrade` condition; recorded in `FEATURE/evidence/other/line-counts-post-impl.<TS>.md`.
+- [x] [P3-T3] Record line counts of `scripts/dependencies/BindingRedirectSync.psm1` and `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (Grep `^`, count) in `FEATURE/evidence/other/line-counts-post-impl.<TS>.md`. Acceptance: both at most 500 and the script above 475; above 500 is STOP: SIZE-LIMIT. Evidence: `FEATURE/evidence/other/line-counts-post-impl.2026-10-09T14-20.md` (307 and 493).
+- [x] [P3-T4] Create `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` per section 6.3 (S1 to S18, in-memory only). Acceptance: Grep count of `^\s+It '` is 18; Grep count of `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` is 0. Evidence: observed 18 and 0; recorded in `FEATURE/evidence/regression-testing/pass-after-redirect-sync.<TS>.md`.
+- [x] [P3-T5] Run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/pass-after-redirect-sync.<TS>.md`. Acceptance: `TEST-PATH-COUNT: 3`; `EXIT_CODE: 0`; `FILE-TESTS BindingRedirectSync.Tests.ps1 ... Failed=0 Total=18`; `FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 ... Failed=0 Total=6`; `FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1 ... Failed=0` with the same `Total=` as that file's `FILE-TESTS` line in P0-T8 (existing contexts unchanged and green). Evidence: `FEATURE/evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md`.
+- [x] [P3-T6] Live-tree check of `scripts/dependencies/Repair-PackageManifestConsistency.ps1` with `-WhatIf`: run `pwsh -NoProfile -File <CMDDIR>\985-repair.ps1 -WorkspaceRoot <WORKTREE> -WhatIfRun`; write `FEATURE/evidence/other/whatif-live-tree.<TS>.md` (`IS-SUCCESS` recorded, not gated). Acceptance: `WRITTEN-COUNT: 0`, `REDIRECTSYNC-REPAIR-COUNT: 0` (main's redirects already satisfy the invariant `BindingRedirectVerification.Tests.ps1` line 275 asserts), `REDIRECTSYNC-UNRESOLVABLE:` empty, and `git status --porcelain` recorded immediately before and immediately after the `985-repair.ps1 -WhatIfRun` call, with the two outputs identical; a non-zero sync count is STOP: LIVE-TREE-SYNC-NONZERO with the `REDIRECTSYNC:` lines reported. Evidence: `FEATURE/evidence/other/whatif-live-tree.2026-10-09T14-21.md`.
+
+### Phase 4 — PowerShell QA Loop
+
+- [x] [P4-T1] Format `scripts/dependencies` and `tests/scripts/dependencies`: record `git status --porcelain` and `git hash-object --no-filters` of the five PowerShell Write Set files, call `mcp__drm-copilot__run_poshqc_format` (`workspace_root = WORKSPACE-ROOT`, `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`), repeat both observations; write `FEATURE/evidence/qa-gates/ps-format.<TS>.md` with `ITERATION:`. Acceptance (success-case observation): porcelain identical and all five hashes identical before and after; any rewrite is a loop restart (C7). Evidence: iteration 2 (passing) `FEATURE/evidence/qa-gates/ps-format.2026-10-09T14-26.md`; iteration 1 `FEATURE/evidence/qa-gates/ps-format.2026-10-09T14-25.md`.
+- [x] [P4-T2] Lint `scripts/dependencies` and `tests/scripts/dependencies` with `mcp__drm-copilot__run_poshqc_analyze` (same arguments); write `FEATURE/evidence/qa-gates/ps-analyze.<TS>.md` with `ITERATION:` and the type-check not-applicable statement. Acceptance: `ok` true. Evidence: iteration 2 (passing) `FEATURE/evidence/qa-gates/ps-analyze.2026-10-09T14-26.md`; iteration 1 (7 findings, fixed) `FEATURE/evidence/qa-gates/ps-analyze.2026-10-09T14-25.md`.
+- [x] [P4-T3] MCP test over `tests/scripts/dependencies`: `985-junit.ps1 -Clear`, `mcp__drm-copilot__run_poshqc_test` (`scan_folders = [tests/scripts/dependencies]`), `985-junit.ps1`; write `FEATURE/evidence/qa-gates/ps-test-mcp.<TS>.md` with `ITERATION:`. Acceptance: `JUNIT-CLEARED: True`; failures 0 and errors 0; `JUNIT-SUITE` lines include `BindingRedirectSync.Tests.ps1` and `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` with non-zero `tests=`. Evidence: `FEATURE/evidence/qa-gates/ps-test-mcp.2026-10-09T14-26.md` (iteration 2).
+- [x] [P4-T4] Direct coverage run (CI mirror) of `scripts/dependencies`, `scripts/hygiene` and `scripts/vscode`: `985-pester.ps1` with the P0-T8 arguments and `-CoverageOutput coverage/985-pester-final.xml`; write `FEATURE/evidence/qa-gates/ps-coverage.<TS>.md` with `ITERATION:`. Acceptance: `TEST-PATH-COUNT: 3` and `COVERAGE-PATH-COUNT: 3`; `EXIT_CODE: 0`, `Failed=0`; `COVERAGE LinePercent` at or above 80.00; the `FILE-COVERAGE` line ending `/BindingRedirectSync.psm1` at or above 90.00; the line ending `/Repair-PackageManifestConsistency.ps1` at or above `BASELINE-REPAIR-SCRIPT-LINE`; `POLICY-85-OBSERVATION: MET|NOT MET` recorded for the aggregate (D6). Evidence: `FEATURE/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md` (iteration 2; aggregate 94.98, module 100.00, repair script 94.14).
+- [x] [P4-T5] Temporary-file audit of `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`, `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` and `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`: Grep `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` (count) over the three files; positive control, the same pattern over `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (its default writer at line 371 uses `WriteAllText`); write `FEATURE/evidence/qa-gates/ps-temp-file-audit.<TS>.md` with `ITERATION:`. Acceptance: 0 for each test file and at least 1 for the control (0 is STOP: SANITIZE-BLIND, the search tool is not reading the files). Evidence: `FEATURE/evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md` (iteration 2).
+- [x] [P4-T6] Final size check of the five PowerShell Write Set files (`scripts/dependencies/BindingRedirectSync.psm1`, `scripts/dependencies/Repair-PackageManifestConsistency.ps1` and the three test files) with Grep `^` counts; write `FEATURE/evidence/qa-gates/ps-line-counts.<TS>.md`. Acceptance: every count at most 500; otherwise STOP: SIZE-LIMIT. Evidence: `FEATURE/evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md`.
+- [x] [P4-T7] Write `FEATURE/evidence/qa-gates/coverage-comparison-powershell.<TS>.md` from P0-T8 and the final-iteration P4-T4: baseline aggregate, final aggregate, delta; `BindingRedirectSync.psm1` (new code) final percent; `Repair-PackageManifestConsistency.ps1` baseline and final percent (changed-file no-regression). Acceptance: all five numbers present; gates as P4-T4; PowerShell branch coverage recorded as "not measured by Pester; no branch gate applies" (`.claude/rules/powershell.md`). Evidence: `FEATURE/evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md`.
+- [x] [P4-T8] Check off AC2 in `FEATURE/spec.md`, citing P3-T5 (behaviours S3, S5, S6, S4, S8, S15/R5 and R1-R4), P3-T2, P4-T6 and P4-T4. Acceptance: Grep `^- \[x\] AC2 ` count 1. Evidence: spec.md `- [x] AC2`; cites `FEATURE/evidence/regression-testing/pass-after-redirect-sync.2026-10-09T14-21.md`, `FEATURE/evidence/other/line-counts-post-impl.2026-10-09T14-20.md`, `FEATURE/evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md`, `FEATURE/evidence/qa-gates/ps-coverage.2026-10-09T14-26.md`.
+
+### Phase 5 — C# QA Loop
+
+- [x] [P5-T1] C# format over the whole tree including `QuickFiler.Test/QuickFiler.Test.csproj`'s project: record `git status --porcelain`; run `985-csharpier.ps1 -WorkspaceRoot <WORKTREE> -Mode format` from `CMDDIR`; record porcelain again; run `-Mode check`; write `FEATURE/evidence/qa-gates/cs-format.<TS>.md` with `ITERATION:`. Acceptance (success-case observation): porcelain identical before and after `format`, and `check` `EXIT_CODE: 0`; a rewrite is a loop restart (C7). Evidence: `FEATURE/evidence/qa-gates/cs-format.2026-10-09T14-30.md`.
+- [x] [P5-T2] Restore `TaskMaster.sln` (now resolving the declarations in `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`) with `985-restore.ps1`; write `FEATURE/evidence/qa-gates/cs-restore.<TS>.md` with `ITERATION:`. Acceptance: `EXIT_CODE: 0`. Evidence: `FEATURE/evidence/qa-gates/cs-restore.2026-10-09T14-30.md`.
+- [x] [P5-T3] Analyzer gate: `985-msbuild.ps1 -WorkspaceRoot <WORKTREE> -Gate Analyzers -LogName 985-final-analyzers.log`; write `FEATURE/evidence/qa-gates/cs-analyzers.<TS>.md` with `ITERATION:`. Acceptance: `EXIT_CODE: 0`, `SUMMARY: 0 Error(s)`, `OUTPUT-ASSEMBLIES:` equal to `BASELINE-OUTPUT-ASSEMBLIES`. Evidence: `FEATURE/evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md`.
+- [x] [P5-T4] Type-check gate: `985-msbuild.ps1 -WorkspaceRoot <WORKTREE> -Gate Nullable -LogName 985-final-nullable.log`; write `FEATURE/evidence/qa-gates/cs-nullable.<TS>.md` with `ITERATION:`. Acceptance: `EXIT_CODE: 0`, `SUMMARY: 0 Error(s)`, `OUTPUT-ASSEMBLIES:` equal to the baseline. Evidence: `FEATURE/evidence/qa-gates/cs-nullable.2026-10-09T14-30.md`.
+- [x] [P5-T5] Test gate with coverage: `985-mstest.ps1 -WorkspaceRoot <WORKTREE> -EvidencePrefix <WORKTREE>\FEATURE\evidence\qa-gates\mstest-coverage-final.<TS>`; write `FEATURE/evidence/qa-gates/cs-test.<TS>.md` with `ITERATION:` and the same lines as P0-T13. Acceptance: `RUNNER_RESULT=COMPLETED` (runner floors line 80 and branch 75 enforced inside the runner), `TRX-SUMMARY: Failed tests: none`, both copies present, `FINAL-CS-LINE:` and `FINAL-CS-BRANCH:` recorded. Evidence: `FEATURE/evidence/qa-gates/cs-test.2026-10-09T14-31.md`.
+- [x] [P5-T6] Write `FEATURE/evidence/qa-gates/coverage-comparison-csharp.<TS>.md`: baseline and final line and branch figures and their deltas, and the changed C# code population from `git diff --numstat BASE-SHA -- *.cs` plus `git status --porcelain -- *.cs` (both empty, so new or changed C# code coverage is not applicable with this proof). Acceptance: four numbers and both empty outputs recorded; a non-empty output is a scope violation reported to the caller. Evidence: `FEATURE/evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md`.
+- [x] [P5-T7] Verify AC4 for `.github/workflows`: run `git diff --name-only BASE-SHA -- .github/workflows` and `git status --porcelain -- .github/workflows`; write `FEATURE/evidence/qa-gates/workflows-untouched.<TS>.md`; then check off AC4 in `FEATURE/spec.md`. Acceptance: both outputs empty; Grep `^- \[x\] AC4 ` count 1. (P8-T2 repeats the committed-range form after the last commit.) Evidence: `FEATURE/evidence/qa-gates/workflows-untouched.2026-10-09T14-31.md`; spec.md `- [x] AC4`.
+- [x] [P5-T8] Check off AC5 in `FEATURE/spec.md`, citing P4-T5 (in-memory only), P4-T4 (new module at or above 90), the single passing iteration of P4-T1 to P4-T5 and of P5-T1 to P5-T5. Acceptance: Grep `^- \[x\] AC5 ` count 1. Evidence: spec.md `- [x] AC5`; cites `FEATURE/evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md`, `FEATURE/evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md`, PowerShell iteration 2 (P4-T1 to P4-T5 all passing, `*.2026-10-09T14-26.md`) and C# iteration 1 (P5-T1 to P5-T5 all passing, `*.2026-10-09T14-30.md` / `*.2026-10-09T14-31.md`).
+
+### Phase 6 — Commit the Fix
+
+- [x] [P6-T1] Run C4 over `FEATURE`, then CMD-COMMIT with paths `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`, `QuickFiler.Test/QuickFiler.Test.csproj`, `scripts/dependencies/BindingRedirectSync.psm1`, `scripts/dependencies/Repair-PackageManifestConsistency.ps1`, the three test files of section 4, `FEATURE`, and every `.claude/agent-memory/` path from a `git status --porcelain` taken just before staging (recorded as `AGENT-MEMORY-LINES:`, C10) (this task's checkbox flipped first), subject `fix(deps): declare borrowed test packages and sync transitive binding redirects (#985)`; then run `git rev-parse HEAD` (`FIX-SHA:`), `git diff --name-only HEAD~1 HEAD` and `git status --porcelain`, in that order and before writing any file, and record the three outputs in `FEATURE/evidence/other/commit-fix.<TS>.md`. Acceptance: the committed name list contains the nine Write Set manifest, code and test paths named in this task and only `FEATURE` and `.claude/agent-memory/` paths besides; excluding `.claude/agent-memory/` lines (C10), every porcelain line is in `PreExistingWorktreePaths` (the feature-folder entry excepted, now committed). The commit-fix artifact itself is written after the commit and is committed by P8-T2. Evidence: `FEATURE/evidence/other/commit-fix.2026-10-09T14-34.md`.
+
+### Phase 7 — Integration Rehearsal (AC6, verification evidence only)
+
+Rule R-FAIL: when any acceptance below fails, append a section `REHEARSAL-VERDICT: FAIL` to the rehearsal file naming the task, the observed values, the sanitized error lines and a classification (`REHEARSAL-ENVIRONMENT-PATH-LENGTH` when `PATH-LENGTH-SIGNATURE-LINES` is above 0, otherwise `REHEARSAL-DEFECT`), leave `REHEARSAL` and `REHEARSAL-BRANCH` in place for diagnosis, and STOP: REHEARSAL-FAILED. The only file this phase adds to the branch is the rehearsal file; every task appends a section to it with its own `Command:`, `EXIT_CODE:` and output lines.
+
+- [x] [P7-T1] Run `git fetch origin dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9` and `git rev-parse DEPENDABOT-REF`; create `FEATURE/evidence/other/integration-rehearsal.<TS>.md` with `Timestamp:`, `Command:` (the fetch), `EXIT_CODE:`, `Output Summary:` (`DEPENDABOT-SHA:`), and `ExpectedExitCode` absent; record the created path as REHEARSAL-FILE (every later Phase 7 append targets REHEARSAL-FILE). Acceptance: fetch exit 0 and a 40-character SHA recorded. Evidence: REHEARSAL-FILE = `FEATURE/evidence/other/integration-rehearsal.2026-10-09T14-35.md`.
+- [x] [P7-T2] Run `git worktree add -b rehearsal-985-throwaway <REHEARSAL> origin/dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9` (path written as `REHEARSAL-ROOT` in the evidence); append `git -C <REHEARSAL> rev-parse HEAD`. Acceptance: exit 0 and `HEAD` equal to `DEPENDABOT-SHA`. Evidence: REHEARSAL-FILE section "P7-T2".
+- [x] [P7-T3] Merge the fix into the rehearsal branch per D2: `git -C <REHEARSAL> merge -X ours --no-edit bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`; append its output (sanitized), `git -C <REHEARSAL> rev-parse HEAD` as `MERGE-SHA:` and `git -C <REHEARSAL> status --porcelain`. Acceptance: exit 0, porcelain empty, `git -C <REHEARSAL> merge-base --is-ancestor FIX-SHA HEAD` exits 0. Evidence: REHEARSAL-FILE section "P7-T3" (MERGE-SHA 37a619f88b82b544c3ef0fa87dd318e917d0d2ad).
+- [x] [P7-T4] Verify the fix content in `REHEARSAL` and re-apply what D2 dropped: (a) for each of `scripts/dependencies/BindingRedirectSync.psm1`, `scripts/dependencies/Repair-PackageManifestConsistency.ps1`, `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`, `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1`, `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`, `git -C <REHEARSAL> rev-parse HEAD:<path>` equals `git rev-parse FIX-SHA:<path>`; (b) Grep in `REHEARSAL` for the four declarations (`id="Microsoft\.Web\.WebView2"` in `QuickFiler.Test/packages.config` and `UtilitiesCS.Test/packages.config`, `id="ObjectListView\.Official"` in `QuickFiler.Test/packages.config` and `TaskTree.Test/packages.config`) and for `Include="Microsoft\.Web\.WebView2\.Core,` in `QuickFiler.Test/QuickFiler.Test.csproj`; insert any missing declaration (the fix's version, immediately before the first package line whose id compares greater, ordinal case-insensitive) and delete a surviving duplicate WebView2.Core item group with the Edit tool; append `REAPPLIED:` lines (or `REAPPLIED: none`). Acceptance: all five blob equalities hold; afterwards each declaration count is 1 and the WebView2.Core `Include` count is 1. Evidence: REHEARSAL-FILE section "P7-T4" (three REAPPLIED lines).
+- [x] [P7-T5] Restore `REHEARSAL\TaskMaster.sln` into `REHEARSAL\packages` (pre-simulation; `nuget update` needs the installed versions): `985-restore.ps1 -WorkspaceRoot <REHEARSAL>`; append. Acceptance: `EXIT_CODE: 0`. Evidence: REHEARSAL-FILE section "P7-T5".
+- [x] [P7-T6] Diagnostic, read-only repair run of `REHEARSAL\scripts\dependencies\Repair-PackageManifestConsistency.ps1` on the literal merge state: `985-repair.ps1 -WorkspaceRoot <REHEARSAL> -WhatIfRun`; append every output line under `DIAGNOSTIC (literal merge, -WhatIf)`. Acceptance: the script completes and prints `WRITTEN-COUNT: 0` and a `REDIRECTSYNC-REPAIR-COUNT:` line (values recorded, not gated; research section 4.2 predicts the five transitive `log4net` redirects); a thrown error is R-FAIL. Evidence: REHEARSAL-FILE section "P7-T6" (REDIRECTSYNC-REPAIR-COUNT 5).
+- [x] [P7-T7] Decide the D1 simulation rows from `REHEARSAL` manifests: read the `Microsoft.Web.WebView2` version in `QuickFiler/packages.config` and `UtilitiesCS/packages.config` and the `ObjectListView.Official` version in `QuickFiler/packages.config` and `TaskTree/packages.config`; append `SIM-ROW:` lines `<test project> <package id> <declared version> <production version> <UPDATE|NONE>` for the four pairs (`UPDATE` when they differ). Acceptance: four `SIM-ROW` lines; the two production WebView2 values agree with each other and the two ObjectListView values agree with each other (otherwise R-FAIL: the branch content is not the expected PR #984 state). Evidence: REHEARSAL-FILE section "P7-T7" (two UPDATE rows, two NONE rows).
+- [x] [P7-T8] Simulated Dependabot update (D1) of each `UPDATE` row in `REHEARSAL` (for example `QuickFiler.Test/packages.config`): `985-nuget-update.ps1 -WorkspaceRoot <REHEARSAL> -ProjectDirectory <test project> -PackageId <id> -PackageVersion <production version>`; append each output and then `git -C <REHEARSAL> diff --stat` and `git -C <REHEARSAL> status --porcelain`. Acceptance: each update `EXIT_CODE: 0`; afterwards each updated manifest declares the production version (Grep) and Grep for the old version folder (for example `Microsoft\.Web\.WebView2\.1\.0\.4191\.47`) in the updated test csproj returns 0; `SIM: none required` is recorded when no row says `UPDATE`. Evidence: REHEARSAL-FILE section "P7-T8".
+- [x] [P7-T9] Workflow step "Restore solution" (`.github/workflows/dependabot-repair.yml` line 74) over `REHEARSAL\TaskMaster.sln`: `985-restore.ps1 -WorkspaceRoot <REHEARSAL>`; append. Acceptance: `EXIT_CODE: 0`. Evidence: REHEARSAL-FILE section "P7-T9".
+- [x] [P7-T10] Workflow step "Repair package manifest consistency" (`dependabot-repair.yml` line 80: the branch's script, no arguments): `985-repair.ps1 -WorkspaceRoot <REHEARSAL>` (runs `REHEARSAL\scripts\dependencies\Repair-PackageManifestConsistency.ps1`); append all lines. Acceptance: `EXIT_CODE: 0` and `IS-SUCCESS: True` (the workflow's own failure condition, line 81); `WRITTEN-COUNT`, `REDIRECTSYNC:` lines, `BEYOND-KNOWN-WEAK` and the body recorded. Evidence: REHEARSAL-FILE section "P7-T10" (WRITTEN-COUNT 9, REDIRECTSYNC 7, BEYOND-KNOWN-WEAK 0).
+- [x] [P7-T11] Idempotence (the post-push re-fire) of `REHEARSAL\scripts\dependencies\Repair-PackageManifestConsistency.ps1`: run `985-repair.ps1 -WorkspaceRoot <REHEARSAL>` again; append. Acceptance: `EXIT_CODE: 0`, `IS-SUCCESS: True`, `WRITTEN-COUNT: 0`, `REDIRECTSYNC-REPAIR-COUNT: 0`. Evidence: REHEARSAL-FILE section "P7-T11".
+- [x] [P7-T12] Restore `REHEARSAL\TaskMaster.sln` again after the repair's writes (as CI does on the pushed head): `985-restore.ps1 -WorkspaceRoot <REHEARSAL>`; append. Acceptance: `EXIT_CODE: 0`. Evidence: REHEARSAL-FILE section "P7-T12".
+- [x] [P7-T13] Analyzer build of `REHEARSAL\TaskMaster.sln`: `985-msbuild.ps1 -WorkspaceRoot <REHEARSAL> -Gate Analyzers -LogName 985-rehearsal-analyzers.log`; append the projection lines (`EXIT_CODE`, `OUTPUT-ASSEMBLIES`, `SUMMARY`, `ERROR-LINE-COUNT`, `ERROR`, `PATH-LENGTH-SIGNATURE-LINES`). Acceptance: `EXIT_CODE: 0`, `SUMMARY: 0 Error(s)`, `ERROR-LINE-COUNT: 0`. Evidence: REHEARSAL-FILE section "P7-T13".
+- [x] [P7-T14] Nullable build of `REHEARSAL\TaskMaster.sln`: `985-msbuild.ps1 -WorkspaceRoot <REHEARSAL> -Gate Nullable -LogName 985-rehearsal-nullable.log`; append the same projection lines. Acceptance: `EXIT_CODE: 0`, `SUMMARY: 0 Error(s)`, `ERROR-LINE-COUNT: 0`. Evidence: REHEARSAL-FILE section "P7-T14".
+- [x] [P7-T15] Pester in `REHEARSAL`: `985-pester.ps1 -WorkspaceRoot <REHEARSAL> -TestPath tests/scripts/dependencies/BindingRedirectVerification.Tests.ps1,tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`; append. Acceptance: `TEST-PATH-COUNT: 2`; `EXIT_CODE: 0`, `Failed=0`, both `FILE-TESTS` lines present with `Total=` above 0. Evidence: REHEARSAL-FILE section "P7-T15" (Passed=21 Failed=0).
+- [x] [P7-T16] Append `REHEARSAL-VERDICT: PASS` with a one-line summary per gate (P7-T10, P7-T11, P7-T13, P7-T14, P7-T15) to REHEARSAL-FILE (under `FEATURE/evidence/other/`), then run C4 over `FEATURE`. Acceptance: verdict line present; C4 count 0 and control 1. Evidence: REHEARSAL-FILE section "P7-T16" (REHEARSAL-VERDICT: PASS).
+- [ ] [P7-T17] Remove the rehearsal: `git worktree remove --force <REHEARSAL>`, `git branch -D rehearsal-985-throwaway`; then `git worktree list --porcelain` (no `rehearsal-985` entry), `git branch --list rehearsal-985-throwaway` (empty) and `git ls-remote --heads origin rehearsal-985-throwaway` (empty: never pushed); append these as `CLEANUP:` lines to REHEARSAL-FILE (under `FEATURE/evidence/other/`). Acceptance: all three observations as stated. Execution note (left unchecked): `git worktree remove` was refused by the PreToolUse hook (EPIC_WORKTREE_REMOVAL_BLOCKED: TARGET_WORKTREE_NOT_DERIVABLE); the hook was not bypassed; the worktree and local branch remain; the remote has no such branch; escalated to the caller. Evidence: REHEARSAL-FILE section "P7-T17".
+- [x] [P7-T18] Check off AC6 in `FEATURE/spec.md`, citing REHEARSAL-FILE (P7-T10, P7-T13, P7-T14, P7-T15, P7-T16) and D1. Acceptance: Grep `^- \[x\] AC6 ` count 1. Evidence: spec.md `- [x] AC6`; cites `FEATURE/evidence/other/integration-rehearsal.2026-10-09T14-35.md` (REHEARSAL-VERDICT: PASS).
+
+### Phase 8 — Closeout
+
+- [x] [P8-T1] Write `FEATURE/evidence/other/ac-status.<TS>.md`: the acceptance-criteria-tracking summary (`Source: FEATURE/spec.md`, total 7, checked 6, remaining 1, items remaining: AC7), `AC7: PENDING-CI (checked off by the item's orchestrator after merge and @dependabot recreate on PR #984; D7)`, and the nine helper-script hashes re-read with `git hash-object --no-filters` compared with P0-T3. Acceptance: Grep `^- \[x\] AC[1-6] ` count 6 and `^- \[ \] AC7 ` count 1 in `FEATURE/spec.md`; hashes equal. Evidence: `FEATURE/evidence/other/ac-status.2026-10-09T14-49.md`.
+- [x] [P8-T2] Run C4 over `FEATURE`, then CMD-COMMIT with path `FEATURE` plus every `.claude/agent-memory/` path from a `git status --porcelain` taken just before staging (recorded as `AGENT-MEMORY-LINES:`, C10) (this task's checkbox flipped first), subject `docs(985): record integration rehearsal and acceptance status`; then run `git diff --name-only HEAD~1 HEAD`, `git diff --name-only BASE-SHA HEAD -- .github/workflows` and `git status --porcelain`; write nothing further. Acceptance: the commit succeeds; `git diff --name-only HEAD~1 HEAD` lists only `FEATURE` and `.claude/agent-memory/` paths; the workflows diff is empty; excluding `.claude/agent-memory/` lines (C10, expected none after the commit), every porcelain line is in `PreExistingWorktreePaths`.
+
+## 8. Acceptance Criteria Traceability
+
+| AC | Implementation | Tests | Evidence | Check-off |
+|---|---|---|---|---|
+| AC1 | P2-T1 to P2-T5 | P1-T1 gate `It`, P2-T7 | `FEATURE/evidence/other/manifest-edit-facts.<TS>.md` | P2-T8 |
+| AC2 | P3-T1, P3-T2 | P1-T2, P3-T4, P3-T5 | `FEATURE/evidence/regression-testing/pass-after-redirect-sync.<TS>.md`, `FEATURE/evidence/qa-gates/ps-line-counts.<TS>.md` | P4-T8 |
+| AC3 | P1-T1 | P1-T3, P2-T7 | `FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.<TS>.md`, `FEATURE/evidence/regression-testing/pass-after-orphaned-hintpath.<TS>.md` | P2-T9 |
+| AC4 | scope rule (section 1) | P5-T7, P8-T2 | `FEATURE/evidence/qa-gates/workflows-untouched.<TS>.md` | P5-T7 |
+| AC5 | P1-T2, P3-T4 | P4-T1 to P4-T5, P5-T1 to P5-T5 | `FEATURE/evidence/qa-gates/ps-temp-file-audit.<TS>.md`, `FEATURE/evidence/qa-gates/coverage-comparison-powershell.<TS>.md` | P5-T8 |
+| AC6 | Phase 7 | P7-T10 to P7-T15 | REHEARSAL-FILE (created by P7-T1 under `FEATURE/evidence/other/`) | P7-T18 |
+| AC7 | whole change | CI on PR #984 after recreate | orchestrator post-merge record | not in this plan (D7) |
+
+## 9. Self-Review (this pass)
+
+SELF-REVIEW: RE-DERIVED THIS PASS
+- `QuickFiler.Test/packages.config`: 74 lines, 73 CR; line 41 `Microsoft.TestPlatform.ObjectModel`, 42 `Moq`, 45 `MSTest.TestFramework`, 46 `OpenTelemetry`; no WebView2 or ObjectListView entry.
+- `UtilitiesCS.Test/packages.config`: 110 lines, 109 CR; line 63 `Microsoft.TestPlatform.ObjectModel`, 64 `Mono.Reflection`, 70 `ObjectListView.Official` 2.9.1 (declared, not borrowed).
+- `TaskTree.Test/packages.config`: 69 lines, 68 CR; line 40 `MSTest.TestFramework`, 41 `OpenTelemetry`.
+- `QuickFiler.Test/QuickFiler.Test.csproj`: 572 lines; WebView2.Core `Include` at 388 and 529; HintPaths 389, 392, 530 (WebView2) and 407 (ObjectListView); item group 528-532; line 527 closes the `ProjectReference` group; 533 opens the `Analyzer` group.
+- `UtilitiesCS.Test/UtilitiesCS.Test.csproj`: borrowed WebView2 HintPaths at 815 and 818; ObjectListView HintPath 827. `TaskTree.Test/TaskTree.Test.csproj`: ObjectListView HintPath 178.
+- Production siblings: `QuickFiler/packages.config` 19 (WebView2 1.0.4191.47) and 22 (ObjectListView 2.9.1); `UtilitiesCS/packages.config` 57; `TaskTree/packages.config` 8.
+- `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: 475 lines; imports 67-71; `$written` 382; project write 413-417; app.config pass 424-440, gated at 425 on applied upgrades; loop ends 441; normalisation comment 443-444, call 445-447; default writer `WriteAllText` 371; result object 454-475.
+- `scripts/dependencies/ConsistencyVerifier.psm1`: `Get-DetectionResult` 41-57 (`ExaminedCount`, `Finding`); `Find-OrphanedHintPath` 122-154.
+- `scripts/dependencies/BindingRedirectVerification.psm1`: `ConvertTo-ReferenceVersionMap` 31-72; `Find-StaleBindingRedirect` 74-134 (ordinal `-contains` at 118); import rationale 26-29.
+- `scripts/dependencies/ProjectConsistency.psm1`: `Invoke-BindingRedirectReconciliation` 271-375 (range upper bound and single-version rules 346-358; locals 323-326); export 377-381.
+- `scripts/dependencies/PackageGraph.psm1`: `Get-PackageManifestPath` 87-128 (exclusions 113); `ConvertFrom-AppConfigText` 285-335 (throws at 305); `$script:NewLine` CRLF at 32; `Invoke-ManifestNormalization` 395-455.
+- `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`: 152 lines; module import line 5; Import gate `It` 65-90 (pair discovery 67-73).
+- `tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1`: 429 lines; CRLF normalisation 59-61; `Get-RepairFixture` 86-120; agreeing tree 232-266; `-WhatIf` 268-279; SVGControl scoped `-WhatIf` 356-381.
+- `tests/scripts/dependencies/BindingRedirectVerification.Tests.ps1`: repository invariant `It` at 275 with empty debt (293) and `netstandard` unverifiable (294); range `It` at 320.
+- `.github/workflows/dependabot-repair.yml`: restore 72-74; repair invocation 80; failure check 81-84; comment 87-94; `beyond-known-weak` 95; staging 136.
+- `.github/workflows/_pester.yml`: configuration 40-47; floor 71.
+- `scripts/vscode/Invoke-MSTestWithCoverage.ps1`: argument list 82-94; `Invoke-MSTestWithCoverageMain` parameters 293-301; entry guard 459. `scripts/vscode/Invoke-VSBuild.ps1`: package-reference sync 247-253.
+- `scripts/hygiene/Test-RepositoryHygiene.Rules.ps1`: profile pattern 21; raw-document classifier 57-123. The worktree `.git` pointer file matches the profile pattern once (C4 control).
+- Round 1 (preflight deltas): `UtilitiesCS.Test/packages.config` line 70 declares `ObjectListView.Official` 2.9.1 (P0-T4 now expects 1 there); `scripts/vscode/Install-RepoDotNetSdk.ps1` exists; `.gitignore` line 356 `.dotnet*/` ignores `.dotnet-sdk/`; `scripts/vscode/Invoke-MSTestWithCoverage.ps1` line 262 throws on a non-zero collector exit before the summary is written (lines 430-454), so C7 now reads the trx failed set; `985-pester.ps1` has no remaining direct use of `$TestPath` or `$CoveragePath` after the split lists; no remaining reference to the fixed rehearsal file name outside P7-T1.
+- Sibling re-check: inserting one line in each manifest shifts the following anchors by one (P2-T2 uses 46/47 after P2-T1); deleting 528-532 leaves 388/389/392 unchanged and moves the `Analyzer` group up by five lines; the existing Import `It` and the three other `It` blocks of `RepositoryTreeConsistency.Tests.ps1` are unchanged, so its total becomes 5 (P1-T3, P2-T7).
+
+## 10. Planner Internal Review Record
+
+PLANNER-INTERNAL-REVIEW: PASS
+CITATION-TO-TREE: PASS
+AC-TRACEABILITY: PASS
+SCOPE-BOUNDARY: PASS
+CITATION: QuickFiler.Test/packages.config | lines 41-42 and 45-46 insertion anchors
+CITATION: UtilitiesCS.Test/packages.config | lines 63-64 insertion anchor; line 70 ObjectListView declared
+CITATION: TaskTree.Test/packages.config | lines 40-41 insertion anchor
+CITATION: QuickFiler.Test/QuickFiler.Test.csproj | lines 388-392 references; lines 528-532 duplicate item group
+CITATION: QuickFiler/packages.config | lines 19 and 22 production versions
+CITATION: UtilitiesCS/packages.config | line 57 production WebView2 version
+CITATION: TaskTree/packages.config | line 8 production ObjectListView version
+CITATION: scripts/dependencies/Repair-PackageManifestConsistency.ps1 | lines 67-71, 382, 413-417, 424-447, 454-475
+CITATION: scripts/dependencies/ConsistencyVerifier.psm1 | Find-OrphanedHintPath lines 122-154
+CITATION: scripts/dependencies/BindingRedirectVerification.psm1 | ConvertTo-ReferenceVersionMap lines 31-72
+CITATION: scripts/dependencies/ProjectConsistency.psm1 | Invoke-BindingRedirectReconciliation lines 271-375
+CITATION: scripts/dependencies/PackageGraph.psm1 | Get-PackageManifestPath lines 87-128; Invoke-ManifestNormalization lines 395-455
+CITATION: tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 | Import gate It lines 65-90
+CITATION: tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1 | Get-RepairFixture lines 86-120
+CITATION: tests/scripts/dependencies/BindingRedirectVerification.Tests.ps1 | repository invariant It line 275
+CITATION: .github/workflows/dependabot-repair.yml | lines 72-95 restore, invocation and beyond-known-weak
+CITATION: .github/workflows/_pester.yml | lines 40-47 and 71
+CITATION: scripts/vscode/Invoke-MSTestWithCoverage.ps1 | lines 82-94 and 293-301
+CITATION: scripts/vscode/Invoke-VSBuild.ps1 | lines 247-253 package-reference sync
+CITATION: scripts/hygiene/Test-RepositoryHygiene.Rules.ps1 | lines 5-55 and 57-123
+AC-INVENTORY: AC1, AC2, AC3, AC4, AC5, AC6, AC7
+AC-MAPPING: AC1 | IMPLEMENTATION: P2-T1 to P2-T5 | TESTS: P1-T1 gate It and P2-T7 | EVIDENCE: FEATURE/evidence/other/manifest-edit-facts.TS.md
+AC-MAPPING: AC2 | IMPLEMENTATION: P3-T1 and P3-T2 | TESTS: P1-T2, P3-T4, P3-T5 | EVIDENCE: FEATURE/evidence/regression-testing/pass-after-redirect-sync.TS.md
+AC-MAPPING: AC3 | IMPLEMENTATION: P1-T1 | TESTS: P1-T3 and P2-T7 | EVIDENCE: FEATURE/evidence/regression-testing/fail-before-orphaned-hintpath.TS.md
+AC-MAPPING: AC4 | IMPLEMENTATION: scope rule in section 1 | TESTS: P5-T7 and P8-T2 | EVIDENCE: FEATURE/evidence/qa-gates/workflows-untouched.TS.md
+AC-MAPPING: AC5 | IMPLEMENTATION: P1-T2 and P3-T4 | TESTS: P4-T1 to P4-T5 and P5-T1 to P5-T5 | EVIDENCE: FEATURE/evidence/qa-gates/coverage-comparison-powershell.TS.md
+AC-MAPPING: AC6 | IMPLEMENTATION: Phase 7 | TESTS: P7-T10 to P7-T15 | EVIDENCE: REHEARSAL-FILE created by P7-T1 under FEATURE/evidence/other/
+AC-MAPPING: AC7 | IMPLEMENTATION: whole change | TESTS: required CI checks on PR 984 after recreate | EVIDENCE: orchestrator post-merge CI record
+UNRESOLVED-GAPS: NONE
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T14-55.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T14-55.md
new file mode 100644
index 000000000..62597f0f5
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T14-55.md
@@ -0,0 +1,213 @@
+# Policy Audit: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Branch: `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`
+- Head: `de397b992868882530a447c662d21b3fbff123eb`
+- Base: `origin/main` at merge base `9911fe138952e2b93476850582847c2831e1cbbd` (committed 2026-10-07T08:22:27-04:00)
+- Review timestamp: 2026-10-09T14-55
+- Work mode: `full-bug` (AC source: `spec.md`)
+- Reviewer: feature-review agent
+
+## Template Provenance
+
+The structure of this artifact follows the canonical major headings listed in `.claude/skills/policy-audit-template-usage/SKILL.md` step 5 (Executive Summary, sections 1 to 10, Appendix A and Appendix B); the template-asset selector step was not run from this agent session. The artifact is validated with `validate_orchestration_artifacts` (artifact type `policy-audit`).
+
+## Rejected Scope Narrowing
+
+No scope narrowing was detected in the caller prompt. The caller supplied the base branch, merge base, head and feature folder; these were re-derived (`git merge-base`, `git rev-parse HEAD`) and match. The audit scope is the full branch diff `9911fe138...de397b992` (70 files).
+
+## Executive Summary
+
+The branch declares four borrowed NuGet packages in three test-project manifests, removes a duplicate `Microsoft.Web.WebView2.Core` reference from `QuickFiler.Test.csproj`, adds a solution-wide binding-redirect synchronisation module (`scripts/dependencies/BindingRedirectSync.psm1`), wires it unconditionally into `Repair-PackageManifestConsistency.ps1`, and adds a repository Pester gate over orphaned HintPaths. No production C# source, no `.cs` file and no file under `.github/workflows/**` changed.
+
+Overall verdict: **FAIL (one blocking finding, autonomous)**.
+
+- Toolchain: PASS. PowerShell format, analyze and test pass (executor evidence plus an in-session re-run of the dependencies Pester suite, 178/178). C# format, analyzer rebuild, nullable rebuild and MSTest with coverage pass (executor evidence, 7427/7427).
+- Coverage: PASS for both languages with changed files (PowerShell and C#; see section 1.2.1).
+- Blocking finding B-1: the committed plan `plan.2026-10-09T13-06.md` line 26 embeds the operator account name inside the encoded session-scratchpad directory name, which the repository host-identifier rule prohibits in any committed file. One-line autonomous fix.
+- AC status: 6 of 7 PASS; AC7 is pending CI by design (post-merge, `@dependabot recreate` on PR #984) and is not counted as blocking.
+
+## 1. General Unit Test Policy Compliance
+
+### 1.1 Core principles
+
+| Principle | Verdict | Evidence |
+|---|---|---|
+| Independence | PASS | Every `It` in `BindingRedirectSync.Tests.ps1` builds its own store; `RedirectSync.Tests.ps1` uses Context-scoped `BeforeAll` fixtures. |
+| Isolation | PASS | One behaviour per `It`; module functions tested separately from the composition root. |
+| Fast execution | PASS | Dependencies suite of 178 tests completed in one in-session run. |
+| Determinism | PASS | Inputs are literal strings and hashtables; no clock, RNG or network. |
+| Readability | PASS | Arrange/Act/Assert comments and descriptive `It` names throughout. |
+| No temporary files | PASS | `evidence/qa-gates/ps-temp-file-audit.2026-10-09T14-26.md`: pattern count 0 in all three test files, positive control 1. Reviewer read of the three files confirms no file write. |
+
+### 1.2 Coverage requirements
+
+Coverage thresholds applied: line 85% and branch 75% (branch-capable languages only) per `.claude/rules/quality-tiers.md`; new code at least 90% per CLAUDE.md UT2. Pester measures no branch coverage, so no PowerShell branch threshold is evaluated.
+
+**Coverage Metrics by Language:**
+
+| Language | Files Changed | Tests | Test Result | Baseline Coverage | Post-Change Coverage | New Code Coverage |
+|---|---|---|---|---|---|---|
+| PowerShell | 2 production (1 new, 1 modified), 3 test | Pester 5.6.1 | 438 passed, 0 failed | 94.64% | 94.98% | 100% |
+| C# | 4 build-configuration files (1 csproj, 3 packages.config); 0 .cs files | MSTest | 7427 passed, 0 failed | 85.41% | 85.41% | N/A (no executable source changed) |
+| TypeScript | 0 | none | none | N/A | N/A | N/A |
+| Python | 0 | none | none | N/A | N/A | N/A |
+
+### Coverage Evidence Checklist
+
+- C# baseline coverage artifact: `evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml` with summary `evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.summary.txt`
+- C# post-change coverage artifact: `evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.jacoco.xml` with summary `evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt`; Cobertura root `coverage/coverage.cobertura.xml` read by the reviewer (line-rate 0.854134, branch-rate 0.798288)
+- TypeScript baseline coverage artifact: `N/A - out of scope`
+- TypeScript post-change coverage artifact: `N/A - out of scope`
+- PowerShell baseline coverage artifact: `coverage/985-pester-baseline.xml` (direct Pester JaCoCo, 1765/1865 lines)
+- PowerShell post-change coverage artifact: `coverage/985-pester-final.xml` (direct Pester JaCoCo, 1891/1991 lines) and a reviewer in-session re-run over `scripts/dependencies`
+- Python baseline coverage artifact: `N/A - out of scope`
+- Python post-change coverage artifact: `N/A - out of scope`
+- Per-language comparison summary: section 1.2.1 of this document
+
+### 1.2.1 Per-Language Coverage Comparison
+
+- PowerShell: Baseline: 94.64% lines (1765/1865) -> Post-change: 94.98% lines (1891/1991). Change: +0.34% lines (+126 covered, +126 measured). New/changed-code coverage: 100%. Disposition: PASS. Evidence: coverage/985-pester-baseline.xml; coverage/985-pester-final.xml; evidence/qa-gates/coverage-comparison-powershell.2026-10-09T14-26.md.
+- C#: Baseline: 85.41% lines (56496/66143) / 79.83% branches (13709/17173) -> Post-change: 85.41% lines (56495/66143) / 79.83% branches (13709/17173). Change: 0.00% lines, 0.00% branches (one covered line fewer, run-to-run variance; no .cs file changed). Disposition: PASS. Evidence: evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md; evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt.
+- TypeScript: Baseline: N/A. Post-change: N/A. Change: N/A. Disposition: N/A. Evidence: N/A - zero TypeScript files changed on this branch.
+- Python: Baseline: N/A. Post-change: N/A. Change: N/A. Disposition: N/A. Evidence: N/A - zero Python files changed on this branch.
+
+### 1.2.2 Coverage Verdicts
+
+PowerShell coverage verdict: PASS (direct Pester 94.98% over scripts/dependencies, scripts/hygiene and scripts/vscode; new module BindingRedirectSync.psm1 100.00% lines 114/114; modified Repair-PackageManifestConsistency.ps1 93.83% to 94.14% lines with every changed line hit).
+
+PowerShell bundled PoshQC coverage artifact `artifacts/pester/powershell-coverage.xml`: FAIL (0.00% lines, 0/10477; its 15 packages are all under `.claude/` and `.codex/`, so it never instruments `scripts/`; pre-existing tooling defect, recorded as observation O-1, non-blocking).
+
+Reviewer in-session PowerShell coverage re-run: PASS (178/178 tests, scripts/dependencies 98.33% lines 944/960, BindingRedirectSync.psm1 100.00% 114/114, Repair-PackageManifestConsistency.ps1 94.14% 225/239).
+
+C# coverage verdict: PASS (line 85.41% at or above 85, branch 79.83% at or above 75; no C# executable line changed, so there is no changed-line regression).
+
+Changed-line check for the modified PowerShell script: the uncovered lines in `Repair-PackageManifestConsistency.ps1` at post-change are 56, 114, 126-130, 137, 139-143 and 327; none is a changed line. Changed lines 73, 385, 421, 449, 451, 463-465 and 487-492 all carry hit counts of 1 or more in `coverage/985-pester-final.xml`.
+
+### 1.3 Scenario completeness
+
+PASS. Positive (stale rewrite, transitive rewrite), negative (unknown name, unparsable version, non-configuration text), edge (empty text, block without redirect, single-version `oldVersion`, numeric versus string ordering, ambiguous own reference), error (parser throw) and state (idempotent second pass, `-WhatIf`) scenarios are each pinned by a named `It`.
+
+## 2. General Code Change Policy Compliance
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Design: simplicity and separation of concerns | PASS | Pure text function `Invoke-BindingRedirectSync`; I/O confined to delegates in `Invoke-SolutionBindingRedirectSync`. |
+| Reuse | PASS | Reuses `ConvertFrom-AppConfigText`, `Invoke-BindingRedirectReconciliation`, `ConvertTo-ReferenceVersionMap`, `Get-PackageManifestPath`. |
+| Error handling | PASS | Parser exception propagates; unverifiable and unresolvable names reported in the result, not swallowed. |
+| Logging | PASS | One `Write-Information` summary line, matching the repair script's existing precedent. |
+| File size (500 lines) | PASS | 306, 493, 358, 187, 178 lines (`evidence/qa-gates/ps-line-counts.2026-10-09T14-26.md`; reviewer recount of the module 306). |
+| Public contracts documented | PASS | Comment-based help on all three exported functions and the module header. |
+| Dependencies | PASS | No new package or module dependency beyond in-repo modules. |
+| Host-identifier hygiene in committed files | FAIL | B-1: `plan.2026-10-09T13-06.md` line 26 contains the operator account name in the encoded scratchpad directory name. |
+| Bugfix workflow (failing test first) | PASS | `evidence/regression-testing/fail-before-*.md` (exit 1, right reason) precede `pass-after-*.md`. |
+
+## 3. Language-Specific Code Change Policy Compliance
+
+### 3.1 PowerShell (`.claude/rules/powershell.md`)
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Advanced functions with `CmdletBinding` and named parameters | PASS | All five functions in the module. |
+| `SupportsShouldProcess` on state-changing function | PASS | `Invoke-SolutionBindingRedirectSync`; composition root passes `-WhatIf:$WhatIfPreference` explicitly. |
+| Approved verbs | PASS | `Invoke`, `Format`, `Get`, `Test`; PoshQC analyze clean. |
+| No script-scoped mutable state | PASS | Script-scope values are constant separators and an exclusion list. |
+| Injectable seams (delegate pattern) | PASS | Lister, reader and writer delegates mirror `Invoke-ManifestNormalization`. |
+| PowerShell 7 compatibility | PASS | PoshQC analyze clean (`evidence/qa-gates/ps-analyze.2026-10-09T14-26.md`). |
+
+### 3.2 C# (`CLAUDE.md` C# Code Change Policy)
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Build-configuration edits limited to intent | PASS | `QuickFiler.Test.csproj` diff removes exactly one 5-line `ItemGroup`; one `Microsoft.Web.WebView2.Core` reference remains (reviewer Grep count 1). |
+| Manifest entries at sibling versions | PASS | WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1 match `QuickFiler/`, `UtilitiesCS/` and `TaskTree/` manifests and the existing HintPath folders. |
+| CSharpier | PASS | `evidence/qa-gates/cs-format.2026-10-09T14-30.md` (format no rewrite, check exit 0). |
+| Analyzer rebuild | PASS | `evidence/qa-gates/cs-analyzers.2026-10-09T14-30.md` (0 warnings, 0 errors, 18 assemblies). |
+| Nullable rebuild | PASS | `evidence/qa-gates/cs-nullable.2026-10-09T14-30.md` (0 warnings, 0 errors). |
+
+## 4. Language-Specific Unit Test Policy Compliance
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Pester 5 with Describe/Context/It | PASS | Three test files. |
+| Test location mirrors source | PASS | `tests/scripts/dependencies/` mirrors `scripts/dependencies/`. |
+| Mock signature parity | PASS | No `Mock` used; real code paths over in-memory delegates. |
+| No executable mocking or live executables | PASS | None invoked. |
+| MSTest/Moq/FluentAssertions (C#) | PASS | No C# test changed. |
+
+## 5. Test Coverage Detail
+
+| File | Status | Baseline line | Post-change line | Gate |
+|---|---|---|---|---|
+| `scripts/dependencies/BindingRedirectSync.psm1` | new | absent | 100.00% (114/114) | at least 90% new code: PASS |
+| `scripts/dependencies/Repair-PackageManifestConsistency.ps1` | modified | 93.83% (213/227) | 94.14% (225/239) | at least 85% and no changed-line regression: PASS |
+| `QuickFiler.Test/QuickFiler.Test.csproj` and three `packages.config` | modified | no executable lines | no executable lines | none |
+
+## 6. Test Execution Metrics
+
+| Suite | Result | Source |
+|---|---|---|
+| Pester, dependencies + hygiene + vscode (executor) | 438 passed, 0 failed | `evidence/qa-gates/ps-coverage.2026-10-09T14-26.md` |
+| Pester via PoshQC MCP, dependencies (executor) | 178 tests, 0 failures | `evidence/qa-gates/ps-test-mcp.2026-10-09T14-26.md` |
+| Pester, dependencies (reviewer in-session) | 178 passed, 0 failed, 0 skipped | reviewer run 2026-10-09T14-52 |
+| MSTest, full solution (executor) | 7427 passed, 0 failed | `evidence/qa-gates/cs-test.2026-10-09T14-31.md` |
+| Integration rehearsal on PR #984 branch | analyzer and nullable rebuild 0 errors; BindingRedirectVerification 16/16 | `evidence/other/integration-rehearsal.2026-10-09T14-35.md` |
+
+## 7. Code Quality Checks
+
+| Check | Command | Result | Verdict |
+|---|---|---|---|
+| Confidentiality masking scan | `git diff 9911fe138...HEAD` added lines, case-insensitive sweep for drive roots, the account name, the host name and the user e-mail | 1 hit: account name in `plan.2026-10-09T13-06.md` line 26; host name 0; e-mail 0 | FAIL (B-1) |
+| Suppression scan (added lines) | Grep added lines for `SuppressMessage` and `#pragma` | 0 | PASS |
+| Workflow change scan | `git diff --name-only 9911fe138...HEAD -- .github scripts/benchmarks .github/actions` | empty; rule `modified-workflow-needs-green-run` not triggered | PASS |
+
+## Evidence Location Compliance
+
+`git diff --name-only 9911fe138...HEAD` lists no path under `artifacts/baselines/`, `artifacts/qa/`, `artifacts/evidence/` or `artifacts/coverage/`. All committed evidence is under `<FEATURE>/evidence/{baseline,qa-gates,regression-testing,other}/`. The script `validate_evidence_locations.py` is not present in this checkout (no file found by name search), so the check was performed by diff inspection. Verdict: PASS.
+
+Committed coverage evidence uses the CLAUDE.md projection forms (package-level JaCoCo projection and one-line summary); no raw Cobertura or TRX document is committed. Verdict: PASS.
+
+## 8. Gaps and Exceptions
+
+- B-1 (blocking, autonomous): account name in the committed plan; see the remediation inputs.
+- AC7 is pending CI by design and is verified after merge by the item's orchestrator run.
+- O-1 (non-blocking): the bundled PoshQC coverage artifact instruments only `.claude/` and `.codex/`; the direct Pester projection mirrors CI `_pester.yml` and is the governing figure.
+- O-2 (non-blocking): the PR-context summary classifies `BindingRedirectSync.psm1` as tooling and omits the four manifest and csproj files from its overview list; language scope was derived from `git diff` instead.
+- O-3 (non-blocking): the rehearsal worktree and local branch `rehearsal-985-throwaway` remain outside the repository (cleanup refused by a hook, P7-T17); no remote branch exists.
+
+## 9. Summary of Changes
+
+- `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`: declare the borrowed packages.
+- `QuickFiler.Test/QuickFiler.Test.csproj`: remove the duplicate WebView2.Core `ItemGroup`.
+- `scripts/dependencies/BindingRedirectSync.psm1` (new): stale-only redirect sync, solution wrapper, report formatter.
+- `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: import, override recording, unconditional sync call, `RedirectSync` result field, body block.
+- Tests: `BindingRedirectSync.Tests.ps1` (18), `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (6), one new `It` in `RepositoryTreeConsistency.Tests.ps1`.
+- Feature documents, evidence, and agent-memory index consolidation under `.claude/agent-memory/` (documentation only).
+
+## 10. Compliance Verdict
+
+**FAIL** pending remediation of B-1 (one autonomous blocking finding). All toolchain, coverage and acceptance gates that can be evaluated before merge pass. After B-1 is fixed, the expected verdict is PASS with AC7 pending CI.
+
+## Appendix A: Test Inventory
+
+| Test file | Tests | Status | Scope |
+|---|---|---|---|
+| `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` | 18 | new | module functions |
+| `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` | 6 | new | composition root wiring |
+| `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` | 5 (1 new) | modified | repository invariant gate |
+| `tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1` | 31 | unchanged, green | backward compatibility |
+
+## Appendix B: Toolchain Commands Reference
+
+| Stage | Command | Run by |
+|---|---|---|
+| PowerShell format | `mcp__drm-copilot__run_poshqc_format` (scan folders `scripts/dependencies`, `tests/scripts/dependencies`) | executor |
+| PowerShell lint | `mcp__drm-copilot__run_poshqc_analyze` (same folders) | executor |
+| PowerShell test | `mcp__drm-copilot__run_poshqc_test` (`tests/scripts/dependencies`) | executor |
+| PowerShell coverage (CI mirror) | Pester 5 direct run over `tests/scripts/{dependencies,hygiene,vscode}` with coverage paths `scripts/{dependencies,hygiene,vscode}` | executor |
+| PowerShell coverage (review) | `pwsh -NoProfile -Command` with `New-PesterConfiguration`, `Run.Path = tests/scripts/dependencies`, `CodeCoverage.Path = scripts/dependencies`, output to the session scratchpad | reviewer |
+| C# format | `dotnet tool run csharpier format .` then `dotnet tool run csharpier check .` | executor |
+| C# analyzers | `msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` | executor |
+| C# type check | `msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true` | executor |
+| C# test | `Invoke-MSTestWithCoverage.ps1` (Koverage route) | executor |
+| Diff scope | `git diff --stat 9911fe138...HEAD`; `git diff --name-only 9911fe138...HEAD -- .github` | reviewer |
+| Coverage parsing | Python `xml.etree` over `coverage/985-pester-*.xml`, `artifacts/pester/powershell-coverage.xml`, `coverage/coverage.cobertura.xml` | reviewer |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T15-35.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T15-35.md
new file mode 100644
index 000000000..7352040b1
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T15-35.md
@@ -0,0 +1,213 @@
+# Policy Audit: Dependabot repair, borrowed packages and transitive redirects (Issue #985)
+
+- Branch: `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`
+- Head: `07d3a8a982d605eeb3bca77810955b4de5773ea8`
+- Base: `origin/main` at merge base `9911fe138952e2b93476850582847c2831e1cbbd` (committed 2026-10-07T08:22:27-04:00)
+- Review timestamp: 2026-10-09T15-35 (re-audit after remediation cycle R1, commit `07d3a8a98`)
+- Work mode: `full-bug` (AC source: `spec.md`)
+- Reviewer: feature-review agent
+
+## Template Provenance
+
+The structure of this artifact follows the canonical major headings listed in `.claude/skills/policy-audit-template-usage/SKILL.md` step 5 (Executive Summary, sections 1 to 10, Appendix A and Appendix B); the template-asset selector step was not run from this agent session. The artifact is validated with `validate_orchestration_artifacts` (artifact type `policy-audit`).
+
+## Rejected Scope Narrowing
+
+No scope narrowing was detected in the caller prompt. The caller supplied the base branch, merge base, head and feature folder; the PR-context summary (generated 2026-10-09 19:32:00 UTC) names head `07d3a8a98`, equal to `git rev-parse HEAD`, so it is current. The audit scope is the full branch diff `9911fe138...07d3a8a98` (107 files, +5386/-691), not only the R1 commit.
+
+## Executive Summary
+
+The branch declares four borrowed NuGet packages in three test-project manifests, removes a duplicate `Microsoft.Web.WebView2.Core` reference from `QuickFiler.Test.csproj`, adds a solution-wide binding-redirect synchronisation module (`scripts/dependencies/BindingRedirectSync.psm1`), wires it unconditionally into `Repair-PackageManifestConsistency.ps1`, and adds a repository Pester gate over orphaned HintPaths. Remediation cycle R1 removed the account name from the committed plan (B-1) and, in scope, added a `Direction` field to sync repair records and report lines (CR-1), de-duplicated `WrittenPath` (CR-2) and made the handled-name check case-insensitive (CR-3), each with fail-before and pass-after evidence.
+
+Overall verdict: **PASS (no blocking findings)**.
+
+- B-1 closed: reviewer sweep of all 5386 added lines of `git diff 9911fe138...HEAD` finds 0 occurrences of the account name, its 8.3 short form, the host name, either user e-mail address, or a drive-rooted user-profile path; the positive control (the worktree `.git` pointer file) matches the account token.
+- Toolchain: PASS. PowerShell format, analyze and test pass (executor R1 iteration 1 evidence; reviewer in-session Pester re-run 447/447). C# toolchain evidence from cycle 0 remains valid because R1 changed no C#-family file (`evidence/qa-gates/csharp-not-applicable-r1.2026-10-09T15-30.md`, confirmed by `git show --stat 07d3a8a98`).
+- Coverage: PASS for both languages with changed files (PowerShell and C#; section 1.2.1).
+- AC status: 6 of 7 PASS; AC7 is pending CI by design (post-merge `@dependabot recreate` on PR #984) and is not a blocking finding.
+
+## 1. General Unit Test Policy Compliance
+
+### 1.1 Core principles
+
+| Principle | Verdict | Evidence |
+|---|---|---|
+| Independence | PASS | Every `It` in `BindingRedirectSync.Tests.ps1` builds its own text and provider; `RedirectSync.Tests.ps1` uses Context-scoped `BeforeAll` fixtures, including the new double-write Context. |
+| Isolation | PASS | One behaviour per `It`; N1 to N4 each pin one `Direction` outcome, N5 the case-insensitive skip, N8 and N9 separate the fixture guard from the de-duplication assertion. |
+| Fast execution | PASS | Reviewer run of 447 tests over three suites completed in one in-session invocation. |
+| Determinism | PASS | Literal strings and hashtables only; no clock, RNG or network. |
+| Readability | PASS | Arrange/Act/Assert comments; N5 carries a comment explaining the case-insensitive hashtable lookup. |
+| No temporary files | PASS | `evidence/qa-gates/ps-temp-file-audit-r1.2026-10-09T15-29.md`: 0 in both changed test files, positive control at least 1; reviewer read confirms in-memory stores (`X:\fixture\...` keys). |
+
+### 1.2 Coverage requirements
+
+Coverage thresholds applied: line 85% and branch 75% (branch-capable languages only) per `.claude/rules/quality-tiers.md`; new code at least 90% per CLAUDE.md UT2. Pester measures no branch coverage, so no PowerShell branch threshold is evaluated.
+
+**Coverage Metrics by Language:**
+
+| Language | Files Changed | Tests | Test Result | Baseline Coverage | Post-Change Coverage | New Code Coverage |
+|---|---|---|---|---|---|---|
+| PowerShell | 2 production (1 new, 1 modified), 3 test | Pester 5.6.1 | 447 passed, 0 failed | 94.64% | 94.99% | 100% |
+| C# | 4 build-configuration files (1 csproj, 3 packages.config); 0 .cs files | MSTest | 7427 passed, 0 failed | 85.41% | 85.41% | N/A (no executable source changed) |
+| TypeScript | 0 | none | none | N/A | N/A | N/A |
+| Python | 0 | none | none | N/A | N/A | N/A |
+
+### Coverage Evidence Checklist
+
+- C# baseline coverage artifact: `evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.jacoco.xml` with summary `evidence/baseline/mstest-coverage-baseline.2026-10-09T14-11.summary.txt`
+- C# post-change coverage artifact: `evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.jacoco.xml` with summary `evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt` (no C#-family file changed after this run)
+- TypeScript baseline coverage artifact: `N/A - out of scope`
+- TypeScript post-change coverage artifact: `N/A - out of scope`
+- PowerShell baseline coverage artifact: `coverage/985-pester-baseline.xml` (branch baseline, 1765/1865 lines) and `coverage/985r1-pester-baseline.xml` (R1 start, 1891/1991 lines)
+- PowerShell post-change coverage artifact: `coverage/985r1-pester-final.xml` (1898/1998 lines) and a reviewer in-session re-run to the session scratchpad with identical figures
+- Python baseline coverage artifact: `N/A - out of scope`
+- Python post-change coverage artifact: `N/A - out of scope`
+- Per-language comparison summary: section 1.2.1 of this document
+
+### 1.2.1 Per-Language Coverage Comparison
+
+- PowerShell: Baseline: 94.64% lines (1765/1865) -> Post-change: 94.99% lines (1898/1998). Change: +0.35% lines (+133 covered, +133 measured). New/changed-code coverage: 100%. Disposition: PASS. Evidence: evidence/baseline/ps-coverage.2026-10-09T14-04.md; evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md; evidence/qa-gates/coverage-comparison-powershell-r1.2026-10-09T15-29.md.
+- C#: Baseline: 85.41% lines (56496/66143) / 79.83% branches (13709/17173) -> Post-change: 85.41% lines (56495/66143) / 79.83% branches (13709/17173). Change: 0.00% lines, 0.00% branches (one covered line fewer, run-to-run variance; no .cs file changed). Disposition: PASS. Evidence: evidence/qa-gates/coverage-comparison-csharp.2026-10-09T14-31.md; evidence/qa-gates/mstest-coverage-final.2026-10-09T14-31.summary.txt.
+- TypeScript: Baseline: N/A. Post-change: N/A. Change: N/A. Disposition: N/A. Evidence: N/A - zero TypeScript files changed on this branch.
+- Python: Baseline: N/A. Post-change: N/A. Change: N/A. Disposition: N/A. Evidence: N/A - zero Python files changed on this branch.
+
+### 1.2.2 Coverage Verdicts
+
+PowerShell coverage verdict: PASS (direct Pester 94.99% over scripts/dependencies, scripts/hygiene and scripts/vscode; new module BindingRedirectSync.psm1 100.00% lines 120/120; modified Repair-PackageManifestConsistency.ps1 94.14% to 94.17% lines with every changed line hit).
+
+PowerShell bundled PoshQC coverage artifact `artifacts/pester/powershell-coverage.xml`: FAIL (0.00% lines, 0/10477, regenerated 2026-10-09 15:27 by the R1 MCP test run; its 15 packages do not include `scripts/`, so it never instruments the changed files; pre-existing tooling defect, observation O-1, non-blocking).
+
+Reviewer in-session PowerShell coverage re-run: PASS (447/447 tests, aggregate 94.99% lines 1898/1998, BindingRedirectSync.psm1 100.00% 120/120, Repair-PackageManifestConsistency.ps1 94.17% 226/240).
+
+C# coverage verdict: PASS (line 85.41% at or above 85, branch 79.83% at or above 75; no C# executable line changed, so there is no changed-line regression).
+
+Changed-line check for the modified PowerShell script: the uncovered lines in `Repair-PackageManifestConsistency.ps1` in the reviewer run are 56, 114, 126-130, 137, 139-143 and 327; none is a changed line. The R1 lines 466-467 (`$distinctWritten`) and 476 (`WrittenPath`) are hit, as are the cycle-0 changed lines.
+
+### 1.3 Scenario completeness
+
+PASS. Positive (stale rewrite, transitive rewrite, upgrade direction), negative (unknown name, unparsable version, non-configuration text), edge (empty text, block without redirect, single-version `oldVersion`, numeric versus string ordering, numerically equal but textually different versions, case-variant duplicate names, a file written by two passes), error (parser throw) and state (idempotent second pass, `-WhatIf`) scenarios are each pinned by a named `It`.
+
+## 2. General Code Change Policy Compliance
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Design: simplicity and separation of concerns | PASS | `Get-RedirectDirection` is a small pure private helper; de-duplication is a single filter at the publication point. |
+| Reuse | PASS | Existing parser and reconciler reused; no logic duplicated. |
+| Error handling | PASS | Unparsable versions classify as `Unknown` rather than throwing; parser exceptions still propagate. |
+| Logging | PASS | No new output; the existing `Write-Information` summary is unchanged. |
+| File size (500 lines) | PASS | HEAD line counts: module 328, repair script 495, `BindingRedirectSync.Tests.ps1` 440, `RedirectSync.Tests.ps1` 218, `RepositoryTreeConsistency.Tests.ps1` 178. |
+| Public contracts documented | PASS | `.DESCRIPTION` and `.OUTPUTS` help updated for the case-insensitive skip and the `Direction` field. |
+| Dependencies | PASS | None added. |
+| Host-identifier hygiene in committed files | PASS | Reviewer sweep of added lines: 0 hits for every token class (section 7). B-1 closed. |
+| Bugfix workflow (failing test first) | PASS | `evidence/regression-testing/fail-before-sync-module.2026-10-09T15-22.md` (7 failures, right reason) and `fail-before-repair-written-path.2026-10-09T15-22.md` (2 failures, right reason) precede the pass-after artifacts. |
+
+## 3. Language-Specific Code Change Policy Compliance
+
+### 3.1 PowerShell (`.claude/rules/powershell.md`)
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Advanced functions with `CmdletBinding` and named parameters | PASS | `Get-RedirectDirection` declares `[CmdletBinding()]`, `[OutputType([string])]` and mandatory typed parameters. |
+| `SupportsShouldProcess` on state-changing function | PASS | Unchanged; `Invoke-SolutionBindingRedirectSync`. |
+| Approved verbs | PASS | `Get` for the new helper; PoshQC analyze clean (`evidence/qa-gates/ps-analyze-r1.2026-10-09T15-26.md`). |
+| No script-scoped mutable state | PASS | `$distinctWritten` is a local of the script body, created once per run. |
+| Private helper not exported | PASS | `Export-ModuleMember` lists only the three public functions. |
+| Formatting | PASS | `evidence/qa-gates/ps-format-r1.2026-10-09T15-26.md`: no rewrite (porcelain and four hashes identical). |
+
+### 3.2 C# (`CLAUDE.md` C# Code Change Policy)
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Build-configuration edits limited to intent | PASS | Unchanged since cycle 0: one 5-line `ItemGroup` removed from `QuickFiler.Test.csproj`; one WebView2.Core reference remains. |
+| Manifest entries at sibling versions | PASS | WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1 match the production manifests and HintPath folders. |
+| CSharpier, analyzer rebuild, nullable rebuild | PASS | `evidence/qa-gates/cs-format.2026-10-09T14-30.md`, `cs-analyzers.2026-10-09T14-30.md`, `cs-nullable.2026-10-09T14-30.md`; R1 changed no C#-family file. |
+
+## 4. Language-Specific Unit Test Policy Compliance
+
+| Rule | Verdict | Evidence |
+|---|---|---|
+| Pester 5 with Describe/Context/It | PASS | Three test files; one new Context. |
+| Test location mirrors source | PASS | `tests/scripts/dependencies/` mirrors `scripts/dependencies/`. |
+| Mock signature parity | PASS | No `Mock`; in-memory delegates. |
+| No executable mocking or live executables | PASS | None invoked. |
+| MSTest/Moq/FluentAssertions (C#) | PASS | No C# test changed. |
+
+## 5. Test Coverage Detail
+
+| File | Status | Baseline line | Post-change line | Gate |
+|---|---|---|---|---|
+| `scripts/dependencies/BindingRedirectSync.psm1` | new | absent | 100.00% (120/120) | at least 90% new code: PASS |
+| `scripts/dependencies/Repair-PackageManifestConsistency.ps1` | modified | 93.83% (213/227) | 94.17% (226/240) | at least 85% and no changed-line regression: PASS |
+| `QuickFiler.Test/QuickFiler.Test.csproj` and three `packages.config` | modified | no executable lines | no executable lines | none |
+
+## 6. Test Execution Metrics
+
+| Suite | Result | Source |
+|---|---|---|
+| Pester, dependencies + hygiene + vscode (executor R1) | 447 passed, 0 failed | `evidence/qa-gates/ps-coverage-r1.2026-10-09T15-29.md` |
+| Pester via PoshQC MCP, dependencies (executor R1) | 187 tests, 0 failures, 0 errors | `evidence/qa-gates/ps-test-mcp-r1.2026-10-09T15-27.md` |
+| Pester, dependencies + hygiene + vscode (reviewer in-session) | 447 passed, 0 failed, 0 skipped | reviewer run 2026-10-09T15-34 |
+| MSTest, full solution (executor cycle 0) | 7427 passed, 0 failed | `evidence/qa-gates/cs-test.2026-10-09T14-31.md` |
+| Integration rehearsal on PR #984 branch (cycle 0) | analyzer and nullable rebuild 0 errors; BindingRedirectVerification 16/16 | `evidence/other/integration-rehearsal.2026-10-09T14-35.md` |
+| Live-tree `-WhatIf` smoke (R1) | 0 written, 0 sync repairs, porcelain unchanged | `evidence/other/whatif-live-tree-r1.2026-10-09T15-26.md` |
+
+## 7. Code Quality Checks
+
+| Check | Command | Result | Verdict |
+|---|---|---|---|
+| Confidentiality masking scan | `git diff --unified=0 9911fe138...HEAD` added lines (5386), case-insensitive fixed-string match for the account name, its 8.3 short form, the host name and both user e-mail addresses, plus a drive-rooted user-profile regex | 0 hits for every token; positive control on the `.git` pointer file matched | PASS |
+| Suppression scan (added lines under `scripts/` and `tests/`) | match for `SuppressMessage`, `#pragma`, `ExcludeFromCodeCoverage` | 0 | PASS |
+| Workflow change scan | `git diff --name-only 9911fe138...HEAD -- .github scripts/benchmarks .github/actions artifacts` | empty; rule `modified-workflow-needs-green-run` not triggered | PASS |
+
+## Evidence Location Compliance
+
+`git diff --name-only 9911fe138...HEAD -- artifacts` is empty, so no path under `artifacts/baselines/`, `artifacts/qa/`, `artifacts/evidence/` or `artifacts/coverage/` is committed. All committed evidence is under `<FEATURE>/evidence/{baseline,remediation-baseline,qa-gates,regression-testing,other}/`. The script `validate_evidence_locations.py` is not present in this checkout (`scripts/dev_tools/validate_evidence_locations.py` does not exist), so the check was performed by diff inspection. Verdict: PASS.
+
+Committed coverage evidence uses the CLAUDE.md projection forms (package-level JaCoCo projection and one-line summary for C#; Markdown summaries for PowerShell); no raw Cobertura or TRX document is committed. Verdict: PASS.
+
+## 8. Gaps and Exceptions
+
+- B-1 from review 2026-10-09T14-55: closed (section 7).
+- AC7 is pending CI by design and is verified after merge by the item's orchestrator run.
+- O-1 (non-blocking): the bundled PoshQC coverage artifact still does not instrument `scripts/`; the direct Pester figures mirror CI `_pester.yml` and govern.
+- O-2 (non-blocking): the PR-context summary classifies `BindingRedirectSync.psm1` as tooling and omits the manifest and csproj files from its overview list; language scope was derived from `git diff`.
+- O-3 (non-blocking): the rehearsal worktree and local branch `rehearsal-985-throwaway` still exist outside the repository tree; no remote branch exists.
+- The workflow comment drift noted in the prior review is promoted to issue #986 (`docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md`).
+
+## 9. Summary of Changes
+
+- `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`: declare the borrowed packages.
+- `QuickFiler.Test/QuickFiler.Test.csproj`: remove the duplicate WebView2.Core `ItemGroup`.
+- `scripts/dependencies/BindingRedirectSync.psm1` (new): stale-only redirect sync, solution wrapper, report formatter; R1 adds `Get-RedirectDirection`, the `Direction` record field and report suffix, and the case-insensitive handled-name set.
+- `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: import, override recording, unconditional sync call, `RedirectSync` result field, body block; R1 de-duplicates `WrittenPath`.
+- Tests: `BindingRedirectSync.Tests.ps1` (24), `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (9), one new `It` in `RepositoryTreeConsistency.Tests.ps1`.
+- Feature documents, evidence, review artifacts, the issue #986 promoted record and agent-memory notes (documentation only).
+
+## 10. Compliance Verdict
+
+**PASS.** No blocking finding remains. All toolchain, coverage and pre-merge acceptance gates pass; AC7 remains pending CI after merge.
+
+## Appendix A: Test Inventory
+
+| Test file | Tests | Status | Scope |
+|---|---|---|---|
+| `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` | 24 | new | module functions |
+| `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` | 9 | new | composition root wiring |
+| `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` | 5 (1 new) | modified | repository invariant gate |
+| `tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1` | 31 | unchanged, green | backward compatibility |
+
+## Appendix B: Toolchain Commands Reference
+
+| Stage | Command | Run by |
+|---|---|---|
+| PowerShell format | `mcp__drm-copilot__run_poshqc_format` (scan folders `scripts/dependencies`, `tests/scripts/dependencies`) | executor |
+| PowerShell lint | `mcp__drm-copilot__run_poshqc_analyze` (same folders) | executor |
+| PowerShell test | `mcp__drm-copilot__run_poshqc_test` (`tests/scripts/dependencies`) | executor |
+| PowerShell coverage (CI mirror) | Pester 5 direct run over `tests/scripts/{dependencies,hygiene,vscode}` with coverage paths `scripts/{dependencies,hygiene,vscode}` | executor and reviewer |
+| C# format | `dotnet tool run csharpier format .` then `dotnet tool run csharpier check .` | executor (cycle 0) |
+| C# analyzers | `msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` | executor (cycle 0) |
+| C# type check | `msbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" /p:TreatWarningsAsErrors=true` | executor (cycle 0) |
+| C# test | `Invoke-MSTestWithCoverage.ps1` (Koverage route) | executor (cycle 0) |
+| Diff scope | `git diff --shortstat 9911fe138...HEAD`; `git show --stat 07d3a8a98`; `git diff --name-only 9911fe138...HEAD -- .github scripts/benchmarks .github/actions artifacts` | reviewer |
+| Identity sweep | `pwsh -NoProfile -Command` over `git diff --unified=0 9911fe138...HEAD` added lines | reviewer |
+| Coverage parsing | PowerShell `[xml]` over the reviewer JaCoCo output and `artifacts/pester/powershell-coverage.xml` | reviewer |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-inputs.2026-10-09T14-55.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-inputs.2026-10-09T14-55.md
new file mode 100644
index 000000000..e6318d9bb
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-inputs.2026-10-09T14-55.md
@@ -0,0 +1,41 @@
+# Remediation Inputs: Issue #985 (review 2026-10-09T14-55)
+
+Review-Verdict: REMEDIATION_REQUIRED
+
+- Feature folder: `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985`
+- Branch head reviewed: `de397b992868882530a447c662d21b3fbff123eb`; merge base `9911fe138952e2b93476850582847c2831e1cbbd`
+- Source audit artifacts:
+  - `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/policy-audit.2026-10-09T14-55.md`
+  - `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/code-review.2026-10-09T14-55.md`
+  - `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/feature-audit.2026-10-09T14-55.md`
+- Next link: `atomic-planner` authors the remediation plan per `remediation-handoff-atomic-planner`; this review does not author the plan.
+
+## Remediation-Required Findings
+
+### B-1 Account name embedded in the committed plan
+
+- Severity: Blocking
+Remediability: autonomous
+Remediability-Evidence: a one-line text substitution in a tracked Markdown document inside the feature folder; no external system, policy decision, or CI result is involved.
+- File: `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/plan.2026-10-09T13-06.md`, line 26 (the `SCRATCH` definition bullet).
+- Problem: the line writes the encoded session-scratchpad directory name twice (once in prose, once inside the `Join-Path` command). That encoded segment contains the operator account name. The repository host-identifier rule (`.claude/agent-memory/_shared_no_absolute_host_paths.md`) prohibits an account name in any committed file.
+- Expected behaviour after the fix: no added line in `git diff 9911fe138...HEAD` contains the account name, a drive-rooted path, the host name, or the user e-mail address.
+- Fix: replace the encoded directory segment in both occurrences with a placeholder such as `<encoded-worktree>\<session-id>` (keep the remaining text of the bullet unchanged), then commit.
+- Verification commands:
+  - `git diff 9911fe138952e2b93476850582847c2831e1cbbd...HEAD` piped to a case-insensitive fixed-string search for the account name, restricted to added lines: expect 0 matches.
+  - The same sweep for the host name and the user e-mail: expect 0 matches.
+  - Re-run the sweep over the remediation cycle's own plan and audit documents (cycle-document sweep scope).
+
+## Non-Blocking Items (no remediation required in this cycle)
+
+- AC7 is pending CI by design (post-merge, `@dependabot recreate` on PR #984); the item's orchestrator run checks it off after CI is observed.
+- Code-review Minor items: downgrade visibility in the sync report; workflow comment drift in `.github/workflows/dependabot-repair.yml` lines 87-105 (requires a separate change because this item excludes workflow edits); possible duplicate entries in `WrittenPath`. Recommend follow-up issues through the MCP promotion lifecycle.
+- O-1: the bundled PoshQC coverage document `artifacts/pester/powershell-coverage.xml` instruments only `.claude/` and `.codex/`; direct Pester figures govern.
+- O-3: rehearsal worktree and local branch `rehearsal-985-throwaway` remain outside the repository.
+
+## Do Not Do
+
+- Do not modify production or test code, manifests, or `.github/workflows/**` in this cycle.
+- Do not edit policy documents under `.claude/rules/` or `.github/instructions/`.
+- Do not alter acceptance-criteria text or check off AC7.
+- Do not rewrite evidence files other than to remove the identifier if the sweep finds it elsewhere.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-plan.2026-10-09T14-55.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-plan.2026-10-09T14-55.md
new file mode 100644
index 000000000..11795ac4b
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/remediation-plan.2026-10-09T14-55.md
@@ -0,0 +1,261 @@
+# 2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects (Remediation Plan R1)
+
+- **Issue:** #985
+- **Cycle:** remediation cycle 1 (R1), from review `2026-10-09T14-55`
+- **Owner:** drmoisan
+- **Last Updated:** 2026-10-09
+- **Status:** Complete (executed in commit 07d3a8a98; re-audit 2026-10-09T15-35 PASS)
+- **Work Mode:** full-bug (AC source: `spec.md`; this cycle changes no AC text and checks off no AC)
+- **Inputs:** `FEATURE/remediation-inputs.2026-10-09T14-55.md` (B-1), `FEATURE/code-review.2026-10-09T14-55.md` (Minor rows 2 and 4, Info row 1)
+
+**Fail-closed evidence rule:** every artifact named below is required. A missing artifact, or a placeholder where a number is required, makes the outcome INCOMPLETE, never PASS.
+
+## 1. Objective
+
+Close the four remediation items of review `2026-10-09T14-55` on this item's own files:
+
+- **B-1 (Blocking).** Remove the operator account name from `FEATURE/plan.2026-10-09T13-06.md` line 26 (the encoded session-scratchpad segment, two occurrences), then sweep every line the branch adds against the merge base (tracked added lines plus every untracked file, including `.claude/agent-memory/`) for the account name, the host name, the user e-mail and drive-rooted user-profile paths, and fix every further hit.
+- **CR-1.** `scripts/dependencies/BindingRedirectSync.psm1`: every sync repair record carries a `Direction` (`Upgrade`, `Downgrade` or `Unknown`) and the report line states it, so a downward rewrite is visible in the pull-request body.
+- **CR-2.** `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: `WrittenPath` lists each path once (ordinal, case-insensitive), first occurrence order kept.
+- **CR-3.** `scripts/dependencies/BindingRedirectSync.psm1`: the already-handled assembly-name check compares names case-insensitively (assembly names bind case-insensitively in .NET), pinned by a test.
+
+Out of scope (do not edit): every file under `.github/workflows/**` (AC4), `.claude/rules/**`, `.github/instructions/**`, every C# source, project, `packages.config` or `app.config` file, every AC line in `FEATURE/spec.md`.
+
+## 2. Conventions
+
+**C1. Symbols.**
+- `FEATURE` = `docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985`.
+- `WORKTREE` = the executor's worktree root (checkout of branch `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`). Every repository path is relative to `WORKTREE`.
+- `SCRATCH` = the session scratchpad directory named in the executing agent's own environment block. This plan never spells that directory, because its encoded name carries the operator account name (the B-1 defect). `CMDDIR` = `SCRATCH\985r1-cmd` (outside the repository; never committed).
+- `BASE-SHA` = `git merge-base HEAD origin/main`, recorded by P0-T2 (the remediation inputs name `9911fe138952e2b93476850582847c2831e1cbbd`; P0-T2 records the observed value and any difference).
+- `R1-START-SHA` = `git rev-parse HEAD` recorded by P0-T2 (not pinned in this plan).
+- `<TS>` = local time read from the host clock when the task runs: `pwsh -NoProfile -Command "Get-Date -Format yyyy-MM-ddTHH-mm"`. Never composed or estimated.
+
+**C2. Evidence schema.** Every command-step artifact carries, in this order, `Timestamp:`, `Command:`, `EXIT_CODE:`, `ExpectedExitCode:` (only on `[expect-fail]` artifacts), and `Output Summary:` (1 to 20 lines carrying every value the task gates). Evidence lives only under `FEATURE/evidence/<kind>/`, kinds `remediation-baseline`, `regression-testing`, `qa-gates`, `other`. No non-canonical evidence path was supplied by the caller, so no `EVIDENCE_LOCATION_OVERRIDE_REJECTED` record applies.
+
+**C3. Hygiene of written text.** No artifact, plan edit or agent-memory note written in this cycle may contain the account name, the host name, the user e-mail, or a drive-rooted user-profile path. `Command:` fields write `<SCRATCH>\985r1-cmd\<script>` and `WORKSPACE-ROOT`. Placeholders for a removed identifier follow `.claude/agent-memory/_shared_no_absolute_host_paths.md`: `<user>`, `<host>`, `<user-profile>`, `<repo-root>`; an e-mail address becomes `<user-email>`. In an XML-family file the escaped form (`&lt;user&gt;`) is used and the file is re-parsed after the edit. An artifact that records a substitution names the token class only and never quotes the removed value.
+
+**C4. Shell discipline.** Bash permits only `git *` and `pwsh *` segments: no `cd`, use `git -C <dir>` and absolute script paths (`pwsh -NoProfile -File <CMDDIR>\<script>.ps1 ...`). Repository text searches use the Grep tool (a regex engine; `.`, `(`, `)`, `[`, `]`, `{`, `}` in counted tokens are escaped as written).
+
+**C5. Loop rule.** PowerShell loop = P4-T1 to P4-T6. If any step fails, or P4-T1 rewrites any file, fix the cause inside the Write Set (section 4) and restart at P4-T1. Each iteration's artifacts carry `ITERATION: <n>`; only an iteration in which P4-T1 to P4-T6 all pass satisfies Phase 4.
+
+**C6. Stop list.** STOP (record the reason in the task's artifact, leave the task unchecked, report to the caller) on: `STOP: PWSH-UNAVAILABLE`, `STOP: BASELINE-FORMAT-DRIFT` (P0-T5), `STOP: ANALYZE-BASELINE-RED` (P0-T6), `STOP: BASELINE-TEST-RED` (P0-T7, P0-T8), `STOP: SWEEP-BLIND` (any sweep whose controls fail), `STOP: TOKEN-EMPTY` (sweep exit 2), `STOP: WRONG-REASON` (P1-T1, P2-T4, P2-T5), `STOP: LIVE-TREE-SYNC-NONZERO` (P3-T6), `STOP: SIZE-LIMIT` (P3-T3, P4-T6), `STOP: SCOPE-VIOLATION` (P5-T1, P5-T2), `STOP: UNEXPECTED-WORKTREE-PATH` and `STOP: COMMIT-BLOCKED` (P6-T3), `STOP: IDENTITY-RESIDUAL-AFTER-COMMIT` (P6-T3). Loop failures follow C5.
+
+**C7. Agent memory.** Every agent-memory write by the executor happens before P6-T2. A memory write after P6-T2 requires P6-T2 to be re-run before P6-T3. Agent-memory paths dirty at P6-T3 are committed (repository policy: commit all audit-trail evidence; the worktree ends clean).
+
+**C8. Line endings.** `scripts/dependencies/Repair-PackageManifestConsistency.ps1` is CRLF (493 of 493 lines end in a carriage return); `scripts/dependencies/BindingRedirectSync.psm1` and both test files in the Write Set are LF (0 carriage returns). Edits keep each file's existing ending.
+
+## 3. Planner Decisions
+
+- **D1 (scope).** `remediation-inputs.2026-10-09T14-55.md` lists the code-review Minor and Info items as non-blocking and its "Do Not Do" section excludes production and test code. The caller directs this cycle to remediate CR-1, CR-2 and CR-3 in scope, consistent with the repository practice of remediating related defects on the item's own files rather than deferring them. That direction governs; the scope is limited to the two production files and two test files of section 4. The remaining Minor item (comment drift in `.github/workflows/dependabot-repair.yml` lines 87-105) stays out of scope under AC4; the orchestrator has promoted it to issue #986 (promoted record `docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md`), which this cycle commits without content change.
+- **D2 (identity tokens are run-time derived).** The sweep script (section 5) derives the account name from the leaf of `$env:USERPROFILE` (plus the 8.3 short form found in `$env:TEMP`, when it differs), the host name from `$env:COMPUTERNAME` and the e-mail from `git config user.email`. The plan carries the derivation, never the values, so the plan file is itself inside the sweep without an exclusion. Each run proves the matcher is live with two controls: a synthetic string per token (`CONTROL-SYNTHETIC`, every value 1) and the worktree's `.git` pointer file, which names a profile path (`CONTROL-GITFILE-ACCOUNT` at least 1).
+- **D3 (sweep scope).** Before the final commit, the sweep reads every added line of `git diff BASE-SHA` (merge base against the working tree, so committed branch changes and uncommitted edits are both covered) and every line of every untracked, non-ignored file (`git ls-files --others --exclude-standard`), which covers this plan, the review documents, the new evidence and new agent-memory files. After the commit the same script runs in `Committed` mode over `git diff BASE-SHA...HEAD`, the exact range the reviewer swept.
+- **D4 (Direction contract).** `Direction` is `Downgrade` when both versions parse with `[System.Version]::TryParse` and the target is lower, `Upgrade` when both parse and the target is higher, and `Unknown` otherwise (either value unparsable, or the two numerically equal while textually different, for example `3.05.0.0` and `3.5.0.0`). The report line becomes `- <ProjectDirectory>: <AssemblyName> <From> to <To> (<Rule>, <Direction>)`. The `From to To` substring is unchanged, so the existing body assertion in `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` line 158 still holds.
+- **D5 (WrittenPath de-duplication).** Implemented at the publication point in the script with a `HashSet[string]` built on `[System.StringComparer]::OrdinalIgnoreCase`, filtering `$written` in order. `WrittenPath` stays `[string[]]`. The regression test reproduces the duplicate the reviewer described (the sync pass and the normalisation pass both rewrite one `app.config`). A case-variant duplicate is not reachable through the entry point, because every pass enumerates paths from the same lister, so the case-insensitive comparer is fixed by code reading (P3-T2 acceptance) and not by a test.
+- **D6 (CR-3 behaviour).** `Invoke-BindingRedirectReconciliation` already matches the name case-insensitively (`ProjectConsistency.psm1` line 330 `-eq` and line 344 `-notmatch`), so the first record rewrites every case variant of a name; the second record only produced a redundant repair record. The fix replaces the `List[string]` at `BindingRedirectSync.psm1` line 114 with a `HashSet[string]` on `OrdinalIgnoreCase` and lines 121-122 with one `Add` test. The regression test asserts one repair record, two examined entries and both blocks rewritten.
+- **D7 (C# toolchain not re-run).** This cycle changes no `*.cs`, `*.csproj`, `*.props`, `*.targets`, `*.sln` or `*.config` file. P5-T1 proves it with `git diff --name-only R1-START-SHA` plus `git status --porcelain` over those patterns; the cycle-0 C# QA iteration (`FEATURE/evidence/qa-gates/cs-*.2026-10-09T14-30.md` and `cs-test.2026-10-09T14-31.md`) remains the C# record. A non-empty result is `STOP: SCOPE-VIOLATION`.
+- **D8 (PowerShell numbers).** The PoshQC MCP tools return only an `ok` flag and a summary, and the MCP coverage document does not instrument `scripts/dependencies` (review observation O-1). Each MCP step runs for the policy record and is paired with the direct Pester run of section 5 (`985-pester.ps1`, mirroring `.github/workflows/_pester.yml`), which prints pass/fail counts and per-file line coverage.
+- **D9 (coverage gates).** Aggregate line coverage over `scripts/dependencies`, `scripts/hygiene`, `scripts/vscode` at or above 80.00 (CLAUDE.md UT2; the 85 figure in `.claude/rules/quality-tiers.md` is recorded as `POLICY-85-OBSERVATION`); `BindingRedirectSync.psm1` at or above 90.00 (new-code rule); `Repair-PackageManifestConsistency.ps1` per-file line coverage not below its P0-T8 figure (changed lines no-regression). Pester measures no branch coverage, so no branch gate applies to PowerShell.
+
+## 4. Write Set
+
+- Production: `scripts/dependencies/BindingRedirectSync.psm1`, `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (2 production PowerShell files; direct-mode budget 1-3).
+- Tests: `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`, `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1`.
+- Feature folder: `FEATURE/plan.2026-10-09T13-06.md` (line 26 only, plus any further identity hit P1-T1 lists), this plan (checkboxes), the evidence files named below, and any further file P1-T1 lists as carrying an identity hit (identifier substitution only).
+- Committed without content change by this cycle: the review artifacts already in the worktree (`FEATURE/code-review.2026-10-09T14-55.md`, `FEATURE/feature-audit.2026-10-09T14-55.md`, `FEATURE/policy-audit.2026-10-09T14-55.md`, `FEATURE/remediation-inputs.2026-10-09T14-55.md`), the issue #986 promoted record `docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md`, and dirty `.claude/agent-memory/` files (C7), unless P1-T1 lists an identity hit in one of them.
+
+## 5. Helper Scripts (written by P0-T3 into CMDDIR)
+
+Three helpers are copied verbatim from `FEATURE/plan.2026-10-09T13-06.md` section 5, each with the `Format-SafeLine` function (that file's lines 85-94) pasted directly after its `param` block:
+- `985-pester.ps1` = that file's lines 248-307.
+- `985-junit.ps1` = that file's lines 313-329.
+- `985-repair.ps1` = that file's lines 335-361.
+
+The fourth helper is new. **985r1-identity-sweep.ps1**
+
+```powershell
+param(
+    [Parameter(Mandatory = $true)][string]$WorkspaceRoot,
+    [Parameter(Mandatory = $true)][string]$Base,
+    [Parameter(Mandatory = $true)][ValidateSet('WorkingTree', 'Committed')][string]$Mode
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+Set-Location -LiteralPath $WorkspaceRoot
+$token = [ordered]@{
+    ACCOUNT = [string](Split-Path -Leaf $env:USERPROFILE)
+    HOST    = [string]$env:COMPUTERNAME
+    EMAIL   = [string](& git config user.email)
+}
+if ([string]$env:TEMP -match '(?i)[\\/]users[\\/](?<short>[^\\/]+)[\\/]' -and $Matches['short'] -ne $token['ACCOUNT']) {
+    $token['ACCOUNT_SHORT'] = [string]$Matches['short']
+}
+foreach ($key in @($token.Keys)) {
+    if ([string]::IsNullOrWhiteSpace($token[$key])) { "TOKEN-EMPTY: $key"; exit 2 }
+}
+"MODE: $Mode"
+"TOKENS: $(@($token.Keys) -join ',')"
+$pattern = [ordered]@{}
+foreach ($key in @($token.Keys)) { $pattern[$key] = [regex]::new([regex]::Escape($token[$key]), 'IgnoreCase') }
+$pattern['USERS_PATH'] = [regex]::new('[a-z]:[\\/]+users[\\/]+[a-z0-9_.~-]', 'IgnoreCase')
+$synthetic = @(foreach ($key in @($token.Keys)) { "$key=$($pattern[$key].Matches('x' + $token[$key] + 'y').Count)" })
+"CONTROL-SYNTHETIC: $($synthetic -join ' ')"
+$gitFile = Join-Path $WorkspaceRoot '.git'
+$gitFileHit = if (Test-Path -LiteralPath $gitFile -PathType Leaf) { $pattern['ACCOUNT'].Matches([System.IO.File]::ReadAllText($gitFile)).Count } else { -1 }
+"CONTROL-GITFILE-ACCOUNT: $gitFileHit"
+$range = if ($Mode -eq 'Committed') { "$Base...HEAD" } else { $Base }
+$diff = @(& git -c core.quotepath=off diff --no-color --no-ext-diff --unified=0 $range)
+if ($LASTEXITCODE -ne 0) { "GIT-DIFF-EXIT: $LASTEXITCODE"; exit 2 }
+$line = [System.Collections.Generic.List[pscustomobject]]::new()
+$file = ''
+$inHunk = $false
+$number = 0
+foreach ($entry in $diff) {
+    if ($entry.StartsWith('diff --git ')) { $inHunk = $false; $file = ''; continue }
+    if ($entry.StartsWith('@@')) {
+        $inHunk = $true
+        if ($entry -match '\+(?<start>\d+)') { $number = [int]$Matches['start'] }
+        continue
+    }
+    if (-not $inHunk) {
+        if ($entry.StartsWith('+++ ')) { $file = $entry.Substring(4) -replace '^b/', '' }
+        continue
+    }
+    if ($entry.StartsWith('+')) {
+        $line.Add([pscustomobject]@{ File = $file; Number = $number; Text = $entry.Substring(1) })
+        $number++
+    }
+}
+$untracked = @()
+if ($Mode -eq 'WorkingTree') {
+    $untracked = @(& git -c core.quotepath=off ls-files --others --exclude-standard)
+    foreach ($path in $untracked) {
+        $index = 0
+        foreach ($text in [System.IO.File]::ReadAllLines((Join-Path $WorkspaceRoot $path))) {
+            $index++
+            $line.Add([pscustomobject]@{ File = $path; Number = $index; Text = $text })
+        }
+    }
+}
+"ADDED-OR-UNTRACKED-LINES: $($line.Count)"
+"UNTRACKED-FILE-COUNT: $($untracked.Count)"
+$total = 0
+foreach ($key in @($pattern.Keys)) {
+    $hit = @($line | Where-Object { $pattern[$key].IsMatch($_.Text) })
+    "HITS-$($key): $($hit.Count)"
+    foreach ($entry in $hit) { "HIT-$($key): $($entry.File):$($entry.Number)" }
+    $total += $hit.Count
+}
+"HITS-TOTAL: $total"
+if ($total -gt 0) { exit 1 }
+exit 0
+```
+
+The script prints token names, counts and `file:line` locations only; it never prints a token value or a matched line.
+
+## 6. Implementation Contracts
+
+### 6.1 `scripts/dependencies/BindingRedirectSync.psm1` (LF, ASCII only, at most 500 lines; 306 lines before this cycle)
+
+1. Insert a private function `Get-RedirectDirection` after `Test-SyncProjectPath` (which ends at line 72) and before `function Invoke-BindingRedirectSync` (line 74), preceded by a `# Private.` comment stating that it classifies a rewrite by numeric comparison so a downward rewrite is visible in the report, and that an unparsable value or a numerically equal pair yields `Unknown`. Contract: `[CmdletBinding()]`, `[OutputType([string])]`, mandatory `[string]$From` and `[string]$To`; body: `$fromVersion = $null`, `$toVersion = $null`; when `[System.Version]::TryParse($From, [ref]$fromVersion) -and [System.Version]::TryParse($To, [ref]$toVersion)`: return `'Downgrade'` when `$toVersion -lt $fromVersion`, `'Upgrade'` when `$toVersion -gt $fromVersion`; otherwise fall through to `return 'Unknown'`. Not exported.
+2. Replace line 114 (`$handled = [System.Collections.Generic.List[string]]::new()`) with a one-line `#` comment stating that assembly names bind case-insensitively, so a block differing only in letter case names the same assembly, followed by `$handled = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)`.
+3. Replace lines 121-122 (`if ($handled.Contains($record.Name)) { continue }` and `$handled.Add($record.Name)`) with the single line `if (-not $handled.Add($record.Name)) { continue }`.
+4. In the repair record (lines 148-155) add `Direction    = (Get-RedirectDirection -From $record.NewVersion -To $target)` after `Rule`.
+5. In `Format-BindingRedirectSyncReport` change the format string at line 296 to `'- {0}: {1} {2} to {3} ({4}, {5})'` and append `$record.Direction` as the sixth argument.
+6. Help text: in `Invoke-BindingRedirectSync` `.DESCRIPTION`, change "a name already handled in this call is skipped" to state the comparison is case-insensitive, and state in `.OUTPUTS` that each repair record carries `Direction` (`Upgrade`, `Downgrade` or `Unknown`); in `Format-BindingRedirectSyncReport` `.OUTPUTS`, state that each line ends with the rule and the direction.
+
+### 6.2 `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (CRLF, at most 500 lines; 493 before this cycle)
+
+1. After line 465 (`if ($syncReport) { ... }`) insert two lines: a `#` comment stating that a file rewritten by more than one pass is listed once and that Windows paths compare case-insensitively, then `$distinctWritten = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)`.
+2. Replace the right-hand side of the `WrittenPath` entry (line 474, `$written.ToArray()`) with `[string[]]@($written | Where-Object { $distinctWritten.Add($_) })`, keeping the existing `=` column alignment.
+3. No other line changes. Expected length 495.
+
+### 6.3 Test additions
+
+`tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (LF; 358 lines before this cycle). Every fixture in memory, built with the file's existing `Get-AppConfigText` and `Get-VersionProvider`; Arrange-Act-Assert comments as in the existing tests; no name matches the regex `AC` followed by a digit.
+
+Append inside `Describe 'Invoke-BindingRedirectSync (in-memory fixtures)'`, after the CRLF byte-identity `It` (ends at line 270):
+- N1 `It 'marks a rewrite to a higher version as an upgrade'`: redirect `log4net` `0.0.0.0-3.4.0.0` / `3.4.0.0`, deployed `log4net` = `3.5.0.0`. Assert `$result.Repair[0].Direction | Should -BeExactly 'Upgrade'`.
+- N2 `It 'marks a rewrite to a lower version as a downgrade'`: redirect `log4net` `0.0.0.0-3.6.0.0` / `3.6.0.0`, deployed `3.5.0.0`. Assert `To` `3.5.0.0`, `Rule` `HighestDeployed`, `Direction` exactly `Downgrade`, text matches `newVersion="3\.5\.0\.0"`.
+- N3 `It 'marks the direction unknown when the stale version does not parse'`: redirect `log4net` `0.0.0.0-3.4.0.0` / `latest`, deployed `3.5.0.0`. Assert `To` `3.5.0.0` and `Direction` exactly `Unknown`.
+- N4 `It 'marks the direction unknown when the two versions are numerically equal'`: redirect `log4net` `0.0.0.0-3.05.0.0` / `3.05.0.0`, deployed `3.5.0.0`. Assert `To` `3.5.0.0` and `Direction` exactly `Unknown`.
+- N5 `It 'processes an assembly name once when two blocks differ only in letter case'`: two redirects, `log4net` and `Log4Net`, each `0.0.0.0-3.4.0.0` / `3.4.0.0`; deployed map `@{ 'log4net' = @('3.5.0.0') }` (a PowerShell hashtable literal looks keys up case-insensitively, which a comment states). Assert `@($result.Repair).Count | Should -Be 1`, `$result.ExaminedCount | Should -Be 2`, and `[regex]::Matches($result.Text, 'newVersion="3\.5\.0\.0"').Count | Should -Be 2`.
+
+In `Describe 'Format-BindingRedirectSyncReport'`:
+- Modify the existing `It 'returns the heading and one line per repair'` (lines 343-357): add `Direction = 'Upgrade'` to both fixture records and change the two expected lines to `'- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed, Upgrade)'` and `'- Prod: Contoso 1.0.0.0 to 2.0.0.0 (OwnReference, Upgrade)'`.
+- N6 `It 'states a downgrade in the report line'`: one record `ProjectDirectory = 'Tags.Test'; AssemblyName = 'log4net'; From = '3.6.0.0'; To = '3.5.0.0'; Rule = 'HighestDeployed'; Direction = 'Downgrade'`. Assert the second line is exactly `'- Tags.Test: log4net 3.6.0.0 to 3.5.0.0 (HighestDeployed, Downgrade)'`.
+
+`tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (LF; 187 lines before this cycle):
+- N7, inside `Context 'A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied'`, after the `It` ending at line 171: `It 'states the direction of the synchronised redirect in the body'`, asserting `$script:FirstResult.Body | Should -Match 'log4net 3\.4\.0\.0 to 3\.5\.0\.0 \(HighestDeployed, Upgrade\)'`.
+- New `Context 'An application configuration rewritten by both the redirect sync and the normalisation pass'`, inside the `Describe` after the `-WhatIf` context. Its `BeforeAll` builds `$reflowed = $script:TestAppConfig.Replace('    <assemblyBinding xmlns=', "    <assemblyBinding`r`n        xmlns=")` (the `assemblyBinding` start tag split across two lines, which `ConvertTo-AppConfigText` collapses), builds a fixture with `Get-RepairFixture` over the same four files as `Get-TransitiveFixture` plus `$script:TestAppConfigPath = $reflowed` and `-Identity $script:AssemblyIdentity`, and runs the entry point once without `-CandidateUpgrade`, keeping the result and the store. A comment states that the sync pass writes the stale redirect and the normalisation pass then writes the collapsed start tag, so one file is written twice.
+  - N8 `It 'applies both rewrites to the application configuration'`: the stored text matches `newVersion="3\.5\.0\.0"` and `<assemblyBinding xmlns="urn:schemas-microsoft-com:asm\.v1">` (guards N9 against a fixture in which only one pass writes).
+  - N9 `It 'lists the application configuration once in the written paths'`: `@($result.WrittenPath | Where-Object { $_ -eq $script:TestAppConfigPath }).Count | Should -Be 1`.
+
+## 7. Phases
+
+### Phase 0 — Policy Reads and Baselines
+
+- [x] [P0-T1] Read, in this order, `CLAUDE.md`, `.claude/rules/general-code-change.md`, `.claude/rules/general-unit-test.md`, `.claude/rules/quality-tiers.md`, `.claude/rules/powershell.md`, `.claude/rules/tonality.md`, `.claude/rules/plan-acceptance-gates.md`, `.claude/skills/atomic-plan-contract/SKILL.md`, `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`, `.claude/skills/acceptance-criteria-tracking/SKILL.md`, `.claude/agent-memory/_shared_no_absolute_host_paths.md`, then `FEATURE/remediation-inputs.2026-10-09T14-55.md`, `FEATURE/code-review.2026-10-09T14-55.md`, `FEATURE/spec.md`; write `FEATURE/evidence/remediation-baseline/phase0-instructions-read.md` with `Timestamp:`, `Policy Order:` (the order above) and `Files Read:` listing all fourteen paths. Acceptance: the artifact exists with the three fields and fourteen paths. Evidence: `FEATURE/evidence/remediation-baseline/phase0-instructions-read.md`.
+- [x] [P0-T2] Record git state in `FEATURE/evidence/remediation-baseline/git-state.<TS>.md`: `git rev-parse --abbrev-ref HEAD` (must print `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985`), `git rev-parse HEAD` (record as `R1-START-SHA:`), `git merge-base HEAD origin/main` (record as `BASE-SHA:` and state whether it equals the value in C1), `git status --porcelain` (every line verbatim as `PreExistingWorktreePaths:`). Acceptance: branch name matches; both SHAs are 40-character hex; the porcelain lines are recorded. Evidence: `FEATURE/evidence/remediation-baseline/git-state.<TS>.md`.
+- [x] [P0-T3] Write the four helper scripts of section 5 into `CMDDIR` with the Write tool (`985-pester.ps1`, `985-junit.ps1`, `985-repair.ps1` copied from the cited line spans of `FEATURE/plan.2026-10-09T13-06.md` with `Format-SafeLine` pasted after each `param` block; `985r1-identity-sweep.ps1` verbatim from section 5), then record the four names and `git hash-object --no-filters <CMDDIR>\<name>` of each in `FEATURE/evidence/remediation-baseline/helper-scripts.<TS>.md` (paths written as `<SCRATCH>\985r1-cmd\<name>`). Acceptance: four names and four hashes recorded. Evidence: `FEATURE/evidence/remediation-baseline/helper-scripts.<TS>.md`.
+- [x] [P0-T4] Record pre-change tree facts in `FEATURE/evidence/remediation-baseline/tree-facts.<TS>.md` with the Grep tool: line counts (pattern `^`, count) of `scripts/dependencies/BindingRedirectSync.psm1` (306), `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (493), `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (358), `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (187); carriage-return counts (pattern `\r$`) of the same four files (0, 493, 0, 0); in `scripts/dependencies/BindingRedirectSync.psm1` the counts of `\$handled\.Contains\(` (1), `function Get-RedirectDirection` (0) and `Direction` (0); in `scripts/dependencies/Repair-PackageManifestConsistency.ps1` the count of `distinctWritten` (0); in `FEATURE/plan.2026-10-09T13-06.md` the content-mode `-o` matches of `claude.C--Users-` (2, both on line 26) and of `<encoded-worktree>` (0). Acceptance: every observed value equals the parenthesised value; a difference is recorded and reported, and the affected anchors in sections 6.1 to 6.3 are re-derived before Phase 1. Evidence: `FEATURE/evidence/remediation-baseline/tree-facts.<TS>.md`.
+- [x] [P0-T5] PowerShell baseline format: record `git status --porcelain` and `git hash-object --no-filters` of the four PowerShell Write Set files, call `mcp__drm-copilot__run_poshqc_format` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`, then repeat both observations; write `FEATURE/evidence/remediation-baseline/ps-format.<TS>.md` (`EXIT_CODE:` 0 when `ok` is true, else 1; the MCP `summary` verbatim). Acceptance (success-case observation, not the exit code): porcelain identical before and after and all four hashes identical; a rewrite is `STOP: BASELINE-FORMAT-DRIFT` (revert with `git checkout -- <file>` first). Evidence: `FEATURE/evidence/remediation-baseline/ps-format.<TS>.md`.
+- [x] [P0-T6] PowerShell baseline lint: call `mcp__drm-copilot__run_poshqc_analyze` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`; write `FEATURE/evidence/remediation-baseline/ps-analyze.<TS>.md` (`EXIT_CODE:` 0 when `ok` is true, else 1), stating that type checking does not apply to PowerShell (`.claude/rules/powershell.md` toolchain step 3). Acceptance: `ok` true; false is `STOP: ANALYZE-BASELINE-RED`. Evidence: `FEATURE/evidence/remediation-baseline/ps-analyze.<TS>.md`.
+- [x] [P0-T7] PowerShell baseline MCP test: run `pwsh -NoProfile -File <CMDDIR>\985-junit.ps1 -WorkspaceRoot <WORKTREE> -Clear`, call `mcp__drm-copilot__run_poshqc_test` with `workspace_root = WORKSPACE-ROOT` and `scan_folders = [tests/scripts/dependencies]`, then run `985-junit.ps1 -WorkspaceRoot <WORKTREE>` without `-Clear`; write `FEATURE/evidence/remediation-baseline/ps-test-mcp.<TS>.md` with the `ok` flag and the `JUNIT` and `JUNIT-SUITE` lines (`EXIT_CODE:` 1 when failures plus errors is above 0, else 0). Acceptance: `JUNIT-CLEARED: True`, a `JUNIT` line present, failures 0 and errors 0; otherwise `STOP: BASELINE-TEST-RED`. Evidence: `FEATURE/evidence/remediation-baseline/ps-test-mcp.<TS>.md`.
+- [x] [P0-T8] PowerShell baseline direct coverage: run `pwsh -NoProfile -File <CMDDIR>\985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies,tests/scripts/hygiene,tests/scripts/vscode -CoveragePath scripts/dependencies,scripts/hygiene,scripts/vscode -CoverageOutput coverage/985r1-pester-baseline.xml`; write `FEATURE/evidence/remediation-baseline/ps-coverage.<TS>.md` with the `PESTER` and `COVERAGE` lines, every `FILE-TESTS` line, and the `FILE-COVERAGE` lines ending `/BindingRedirectSync.psm1` and `/Repair-PackageManifestConsistency.ps1`. Acceptance: `TEST-PATH-COUNT: 3`, `COVERAGE-PATH-COUNT: 3`, `Failed=0` (otherwise `STOP: BASELINE-TEST-RED`); recorded as numbers: `R1-BASELINE-PS-AGGREGATE:`, `R1-BASELINE-MODULE-LINE:`, `R1-BASELINE-REPAIR-SCRIPT-LINE:`, and `R1-BASELINE-REPAIR-TESTS-TOTAL:` (the `Total=` of `FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1`); the raw document stays under the ignored `coverage/` directory. Evidence: `FEATURE/evidence/remediation-baseline/ps-coverage.<TS>.md`.
+
+### Phase 1 — Identity Hygiene (B-1)
+
+- [x] [P1-T1] [expect-fail] Run `pwsh -NoProfile -File <CMDDIR>\985r1-identity-sweep.ps1 -WorkspaceRoot <WORKTREE> -Base <BASE-SHA> -Mode WorkingTree`; write `FEATURE/evidence/regression-testing/fail-before-identity-sweep.<TS>.md` with `ExpectedExitCode: 1` and every output line. Acceptance (right reason): `EXIT_CODE: 1`; `CONTROL-SYNTHETIC:` shows `=1` for every token and `CONTROL-GITFILE-ACCOUNT:` is at least 1 (otherwise `STOP: SWEEP-BLIND`); a `HIT-ACCOUNT:` line names `FEATURE/plan.2026-10-09T13-06.md:26` (repository-relative); exit 2 is `STOP: TOKEN-EMPTY`; any other exit is `STOP: WRONG-REASON`. Every `HIT-` line other than `plan.2026-10-09T13-06.md:26` is recorded as `FURTHER-HIT:` for P1-T3. Evidence: `FEATURE/evidence/regression-testing/fail-before-identity-sweep.<TS>.md`.
+- [x] [P1-T2] In `FEATURE/plan.2026-10-09T13-06.md` line 26, with the Edit tool, replace each of the two occurrences of the encoded directory segment and the session identifier that follow `Temp\claude\` (the text between `Temp\claude\` and `\scratchpad`) with `<encoded-worktree>\<session-id>`, leaving every other character of the bullet unchanged. Acceptance: Grep content mode `-o` over that file returns 2 matches of `<encoded-worktree>.<session-id>.scratchpad`, both on line 26, and 0 matches of `claude.C--Users-`; the file's line count is unchanged (Grep `^` count equal before and after). Evidence: counts recorded in `FEATURE/evidence/regression-testing/pass-after-identity-sweep.<TS>.md` (P1-T4).
+- [x] [P1-T3] For every `FURTHER-HIT:` line recorded by P1-T1, replace the identifier in that file and line with the C3 placeholder for its token class (`<user>`, `<host>`, `<user-email>`, or a `<user-profile>`-composed path for `USERS_PATH`), escaped in an XML-family file, changing nothing else on the line; record each fix as `FIXED: <file>:<line> <token class>` (never the removed value) in `FEATURE/evidence/regression-testing/pass-after-identity-sweep.<TS>.md`, or record `FURTHER-HITS: NONE` when P1-T1 listed none. Acceptance: one `FIXED:` line per `FURTHER-HIT:` line, or `FURTHER-HITS: NONE`; each rewritten XML-family file parses with `[xml]`. Evidence: `FEATURE/evidence/regression-testing/pass-after-identity-sweep.<TS>.md`.
+- [x] [P1-T4] Re-run `985r1-identity-sweep.ps1 -WorkspaceRoot <WORKTREE> -Base <BASE-SHA> -Mode WorkingTree` from `CMDDIR`; write its output, with the P1-T2 counts and the P1-T3 lines, to `FEATURE/evidence/regression-testing/pass-after-identity-sweep.<TS>.md`. Acceptance: `EXIT_CODE: 0`, `HITS-TOTAL: 0`, every `HITS-` line 0, `CONTROL-SYNTHETIC:` all `=1`, `CONTROL-GITFILE-ACCOUNT:` at least 1. Evidence: `FEATURE/evidence/regression-testing/pass-after-identity-sweep.<TS>.md`.
+
+### Phase 2 — Regression Tests First (CR-1, CR-2, CR-3)
+
+- [x] [P2-T1] Add N1 to N5 of section 6.3 to `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` inside `Describe 'Invoke-BindingRedirectSync (in-memory fixtures)'` with the Edit tool (LF kept). Acceptance: Grep count of `^\s+It '` in the file is 23; each of the five `It` names of N1 to N5 has Grep count 1; Grep count of `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` is 0. Evidence: counts recorded in `FEATURE/evidence/regression-testing/fail-before-sync-module.<TS>.md` (P2-T4).
+- [x] [P2-T2] In `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` `Describe 'Format-BindingRedirectSyncReport'`, modify the existing `It 'returns the heading and one line per repair'` and add N6, per section 6.3. Acceptance: Grep count of `^\s+It '` is 24; Grep counts of `\(HighestDeployed, Upgrade\)'`, `\(OwnReference, Upgrade\)'` and `\(HighestDeployed, Downgrade\)'` are each 1; Grep count of `\(HighestDeployed\)'` is 0. Evidence: counts recorded in `FEATURE/evidence/regression-testing/fail-before-sync-module.<TS>.md` (P2-T4).
+- [x] [P2-T3] Add N7, and the new `Context` with N8 and N9, to `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` per section 6.3. Acceptance: Grep count of `^\s+It '` is 9; Grep count of `^\s+Context '` is 3; Grep count of `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` is 0. Evidence: counts recorded in `FEATURE/evidence/regression-testing/fail-before-repair-written-path.<TS>.md` (P2-T5).
+- [x] [P2-T4] [expect-fail] Run `pwsh -NoProfile -File <CMDDIR>\985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`; write `FEATURE/evidence/regression-testing/fail-before-sync-module.<TS>.md` with `ExpectedExitCode: 1`, the P2-T1 and P2-T2 counts, and every `FAILED-TEST:` and `FAILED-MESSAGE:` line. Acceptance (right reason): `EXIT_CODE: 1`; `PESTER Passed=17 Failed=7` with `Total=24`; the failed set is exactly N1, N2, N3, N4, N5, N6 and `returns the heading and one line per repair`; N5's `FAILED-MESSAGE:` contains `but got 2`. Any other shape is `STOP: WRONG-REASON`. Evidence: `FEATURE/evidence/regression-testing/fail-before-sync-module.<TS>.md`.
+- [x] [P2-T5] [expect-fail] Run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/fail-before-repair-written-path.<TS>.md` with `ExpectedExitCode: 1`, the P2-T3 counts and every `FAILED-TEST:` and `FAILED-MESSAGE:` line. Acceptance (right reason): `EXIT_CODE: 1`; `PESTER Passed=7 Failed=2` with `Total=9`; the failed set is exactly N7 and N9; N9's `FAILED-MESSAGE:` contains `but got 2`; N8 passed. Any other shape is `STOP: WRONG-REASON`. Evidence: `FEATURE/evidence/regression-testing/fail-before-repair-written-path.<TS>.md`.
+
+### Phase 3 — Implementation
+
+- [x] [P3-T1] Apply section 6.1 items 1 to 6 to `scripts/dependencies/BindingRedirectSync.psm1` with the Edit tool (LF, ASCII only). Acceptance: Grep counts in that file: `function Get-RedirectDirection` 1; `HashSet\[string\]\]::new\(\[System\.StringComparer\]::OrdinalIgnoreCase\)` 1; `\$handled\.Contains\(` 0; `if \(-not \$handled\.Add\(` 1; `Direction\s+= \(Get-RedirectDirection` 1; `\(\{4\}, \{5\}\)` 1; `'Get-RedirectDirection'` 0 (not exported); `^Export-ModuleMember` 1; `[^\x00-\x7F]` 0. Evidence: counts recorded in `FEATURE/evidence/other/line-counts-r1.<TS>.md` (P3-T3).
+- [x] [P3-T2] Apply section 6.2 to `scripts/dependencies/Repair-PackageManifestConsistency.ps1` with the Edit tool (CRLF kept). Acceptance: Grep counts in that file: `distinctWritten` 2; `OrdinalIgnoreCase` at least 1 on the `$distinctWritten =` line (read the line to confirm the comparer); `\$written\.ToArray\(\)` 0; carriage-return count (pattern `\r$`) equal to the line count. Evidence: counts recorded in `FEATURE/evidence/other/line-counts-r1.<TS>.md` (P3-T3).
+- [x] [P3-T3] Record line counts (Grep `^`) and carriage-return counts (Grep `\r$`) of `scripts/dependencies/BindingRedirectSync.psm1` and `scripts/dependencies/Repair-PackageManifestConsistency.ps1`, plus the P3-T1 and P3-T2 counts, in `FEATURE/evidence/other/line-counts-r1.<TS>.md`. Acceptance: both line counts at most 500 (expected about 330 and 495); the module's carriage-return count 0 and the script's equal to its line count; above 500 is `STOP: SIZE-LIMIT`. Evidence: `FEATURE/evidence/other/line-counts-r1.<TS>.md`.
+- [x] [P3-T4] Pass-after for the module tests: run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/pass-after-sync-module.<TS>.md`. Acceptance: `EXIT_CODE: 0`; `PESTER Passed=24 Failed=0`; no `FAILED-TEST:` line. Evidence: `FEATURE/evidence/regression-testing/pass-after-sync-module.<TS>.md`.
+- [x] [P3-T5] Pass-after for the entry-point tests: run `985-pester.ps1 -WorkspaceRoot <WORKTREE> -TestPath tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1,tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1` from `CMDDIR`; write `FEATURE/evidence/regression-testing/pass-after-repair-written-path.<TS>.md`. Acceptance: `TEST-PATH-COUNT: 2`; `EXIT_CODE: 0`; `FILE-TESTS Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 Passed=9 Failed=0 Total=9`; `FILE-TESTS Repair-PackageManifestConsistency.Tests.ps1` with `Failed=0` and `Total=` equal to `R1-BASELINE-REPAIR-TESTS-TOTAL`. Evidence: `FEATURE/evidence/regression-testing/pass-after-repair-written-path.<TS>.md`.
+- [x] [P3-T6] Live-tree smoke of `scripts/dependencies/Repair-PackageManifestConsistency.ps1` with `-WhatIf`: record `git status --porcelain`, run `pwsh -NoProfile -File <CMDDIR>\985-repair.ps1 -WorkspaceRoot <WORKTREE> -WhatIfRun`, record `git status --porcelain` again; write `FEATURE/evidence/other/whatif-live-tree-r1.<TS>.md` (`IS-SUCCESS` recorded, not gated). Acceptance: the script completes; `WRITTEN-COUNT: 0`; `REDIRECTSYNC-REPAIR-COUNT: 0`; `REDIRECTSYNC-UNRESOLVABLE:` empty; the two porcelain outputs identical. A non-zero sync count is `STOP: LIVE-TREE-SYNC-NONZERO` with the `REDIRECTSYNC:` lines reported. Evidence: `FEATURE/evidence/other/whatif-live-tree-r1.<TS>.md`.
+
+### Phase 4 — PowerShell QA Loop
+
+- [x] [P4-T1] Format: record `git status --porcelain` and `git hash-object --no-filters` of the four PowerShell Write Set files, call `mcp__drm-copilot__run_poshqc_format` (`workspace_root = WORKSPACE-ROOT`, `scan_folders = [scripts/dependencies, tests/scripts/dependencies]`), repeat both observations; write `FEATURE/evidence/qa-gates/ps-format-r1.<TS>.md` with `ITERATION:`. Acceptance (success-case observation): porcelain identical and all four hashes identical before and after; any rewrite is a loop restart (C5). Evidence: `FEATURE/evidence/qa-gates/ps-format-r1.<TS>.md`.
+- [x] [P4-T2] Lint `scripts/dependencies` and `tests/scripts/dependencies` with `mcp__drm-copilot__run_poshqc_analyze` (same arguments); write `FEATURE/evidence/qa-gates/ps-analyze-r1.<TS>.md` with `ITERATION:` and the type-check not-applicable statement. Acceptance: `ok` true. Evidence: `FEATURE/evidence/qa-gates/ps-analyze-r1.<TS>.md`.
+- [x] [P4-T3] MCP test over `tests/scripts/dependencies`: `985-junit.ps1 -WorkspaceRoot <WORKTREE> -Clear`, `mcp__drm-copilot__run_poshqc_test` (`scan_folders = [tests/scripts/dependencies]`), `985-junit.ps1 -WorkspaceRoot <WORKTREE>`; write `FEATURE/evidence/qa-gates/ps-test-mcp-r1.<TS>.md` with `ITERATION:`. Acceptance: `JUNIT-CLEARED: True`; failures 0 and errors 0; the `JUNIT-SUITE` line for `BindingRedirectSync.Tests.ps1` shows `tests=24` and the line for `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` shows `tests=9`. Evidence: `FEATURE/evidence/qa-gates/ps-test-mcp-r1.<TS>.md`.
+- [x] [P4-T4] Direct coverage run of `scripts/dependencies`, `scripts/hygiene` and `scripts/vscode`: `985-pester.ps1` with the P0-T8 arguments and `-CoverageOutput coverage/985r1-pester-final.xml`; write `FEATURE/evidence/qa-gates/ps-coverage-r1.<TS>.md` with `ITERATION:`. Acceptance: `TEST-PATH-COUNT: 3`, `COVERAGE-PATH-COUNT: 3`, `EXIT_CODE: 0`, `Failed=0`; `COVERAGE LinePercent` at or above 80.00; the `FILE-COVERAGE` line ending `/BindingRedirectSync.psm1` at or above 90.00; the line ending `/Repair-PackageManifestConsistency.ps1` at or above `R1-BASELINE-REPAIR-SCRIPT-LINE`; `POLICY-85-OBSERVATION: MET|NOT MET` recorded for the aggregate (D9). Evidence: `FEATURE/evidence/qa-gates/ps-coverage-r1.<TS>.md`.
+- [x] [P4-T5] Temporary-file audit: Grep `New-TemporaryFile|GetTempPath|GetTempFileName|TestDrive|WriteAllText|Set-Content|Out-File|New-Item` (count) over `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` and `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1`; positive control, the same pattern over `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (its default writer uses `WriteAllText`, line 373); write `FEATURE/evidence/qa-gates/ps-temp-file-audit-r1.<TS>.md` with `ITERATION:`. Acceptance: 0 for each test file and at least 1 for the control (0 is `STOP: SWEEP-BLIND`). Evidence: `FEATURE/evidence/qa-gates/ps-temp-file-audit-r1.<TS>.md`.
+- [x] [P4-T6] Size check of the four PowerShell Write Set files with Grep `^` counts; write `FEATURE/evidence/qa-gates/ps-line-counts-r1.<TS>.md` with `ITERATION:`. Acceptance: every count at most 500; otherwise `STOP: SIZE-LIMIT`. Evidence: `FEATURE/evidence/qa-gates/ps-line-counts-r1.<TS>.md`.
+- [x] [P4-T7] Write `FEATURE/evidence/qa-gates/coverage-comparison-powershell-r1.<TS>.md` from P0-T8 and the passing-iteration P4-T4: baseline and final aggregate and their delta; `BindingRedirectSync.psm1` baseline and final percent (new code, gate 90.00); `Repair-PackageManifestConsistency.ps1` baseline and final percent (changed lines, no regression); PowerShell branch coverage recorded as "not measured by Pester; no branch gate applies". Acceptance: all six numbers present and the P4-T4 gates hold. Evidence: `FEATURE/evidence/qa-gates/coverage-comparison-powershell-r1.<TS>.md`.
+
+### Phase 5 — Scope Proofs (C# and Workflows)
+
+- [x] [P5-T1] C# not-applicable proof (D7): run `git diff --name-only <R1-START-SHA> -- "*.cs" "*.csproj" "*.props" "*.targets" "*.sln" "*.config"` and `git status --porcelain -- "*.cs" "*.csproj" "*.props" "*.targets" "*.sln" "*.config"`; write `FEATURE/evidence/qa-gates/csharp-not-applicable-r1.<TS>.md` with both outputs, `CSHARP-TOOLCHAIN: NOT RE-RUN (no C#-family file changed in R1)`, and the cycle-0 C# QA artifact names found by Glob `FEATURE/evidence/qa-gates/cs-*.md`. Acceptance: both outputs empty and at least four cycle-0 artifact names listed; a non-empty output is `STOP: SCOPE-VIOLATION` (the C# toolchain then becomes mandatory and the caller is notified). Evidence: `FEATURE/evidence/qa-gates/csharp-not-applicable-r1.<TS>.md`.
+- [x] [P5-T2] AC4 re-check for `.github/workflows`: run `git diff --name-only <BASE-SHA> -- .github/workflows` and `git status --porcelain -- .github/workflows`; write `FEATURE/evidence/qa-gates/workflows-untouched-r1.<TS>.md`. Acceptance: both outputs empty; non-empty is `STOP: SCOPE-VIOLATION`. Evidence: `FEATURE/evidence/qa-gates/workflows-untouched-r1.<TS>.md`.
+
+### Phase 6 — Final Hygiene and Commit
+
+- [x] [P6-T1] Write `FEATURE/evidence/other/remediation-r1-summary.<TS>.md` mapping B-1, CR-1, CR-2, CR-3, AC4-RECHECK and AC5-RECHECK to their fail-before and pass-after artifacts and QA-gate artifacts by path, stating that AC7 remains pending CI and no AC checkbox changed in this cycle, and recording the residual of D1 (workflow comment drift) as promoted to issue #986. Acceptance: six item rows, each naming at least one existing artifact path; Grep `^- \[[ x]\] AC` over `FEATURE/spec.md` shows AC1 to AC6 `[x]` and AC7 `[ ]`, unchanged from the start of the cycle. Evidence: `FEATURE/evidence/other/remediation-r1-summary.<TS>.md`.
+- [x] [P6-T2] Final pre-commit identity sweep: run `985r1-identity-sweep.ps1 -WorkspaceRoot <WORKTREE> -Base <BASE-SHA> -Mode WorkingTree` from `CMDDIR` (this covers this plan, the review documents, every evidence file of this cycle and every dirty or new agent-memory file); write `FEATURE/evidence/qa-gates/identity-sweep-final-r1.<TS>.md`. Acceptance: `EXIT_CODE: 0`, `HITS-TOTAL: 0`, `CONTROL-SYNTHETIC:` all `=1`, `CONTROL-GITFILE-ACCOUNT:` at least 1. A hit is fixed per P1-T3 and this task re-run. Evidence: `FEATURE/evidence/qa-gates/identity-sweep-final-r1.<TS>.md`.
+- [x] [P6-T3] Commit: flip this task's checkbox to `[x]`; run `git status --porcelain` and confirm every line is under `FEATURE/`, under `.claude/agent-memory/`, is one of the four Write Set code and test paths, or is `docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md` (issue #986 promoted record) (any other line is `STOP: UNEXPECTED-WORKTREE-PATH`); `git add --` those explicit paths, including `docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md` (never `-A`, never `.`); `git commit -m "fix(deps): remediate review 2026-10-09T14-55 for #985" -m "<body naming B-1, CR-1, CR-2, CR-3>"` plus the trailer `-m` arguments dictated by the executing session's attribution instructions. If `git add` or `git commit` fails or a hook denies it, restore the checkbox to `[ ]` and `STOP: COMMIT-BLOCKED`. Then, writing no file: `git rev-parse HEAD`, `git status --porcelain`, and `985r1-identity-sweep.ps1 -WorkspaceRoot <WORKTREE> -Base <BASE-SHA> -Mode Committed` from `CMDDIR`; report the three outputs in the executor's return message. Acceptance: commit exit 0; post-commit porcelain empty; the Committed-mode sweep prints `HITS-TOTAL: 0` with both controls passing (a non-zero count is `STOP: IDENTITY-RESIDUAL-AFTER-COMMIT`). No push. Evidence: the commit itself (`git log -1 --stat`) and the executor's return message.
+
+## 8. Acceptance Mapping
+
+| ID | Implementation | Tests / checks | Evidence |
+|---|---|---|---|
+| B-1 | P1-T2, P1-T3 | P1-T1 (fail-before), P1-T4, P6-T2, P6-T3 Committed sweep | `regression-testing/fail-before-identity-sweep.<TS>.md`, `regression-testing/pass-after-identity-sweep.<TS>.md`, `qa-gates/identity-sweep-final-r1.<TS>.md` |
+| CR-1 | P3-T1 items 1, 4, 5, 6 | N1 to N4, N6, modified report test, N7 (P2-T4, P2-T5, P3-T4, P3-T5) | `regression-testing/fail-before-sync-module.<TS>.md`, `regression-testing/pass-after-sync-module.<TS>.md` |
+| CR-2 | P3-T2 | N8, N9 (P2-T5, P3-T5) | `regression-testing/fail-before-repair-written-path.<TS>.md`, `regression-testing/pass-after-repair-written-path.<TS>.md` |
+| CR-3 | P3-T1 items 2, 3 | N5 (P2-T4, P3-T4) | `regression-testing/fail-before-sync-module.<TS>.md`, `regression-testing/pass-after-sync-module.<TS>.md` |
+| AC4-RECHECK | none (scope guard) | P5-T2 | `qa-gates/workflows-untouched-r1.<TS>.md` |
+| AC5-RECHECK | Phase 4 loop | P4-T1 to P4-T7, P5-T1 | `qa-gates/ps-coverage-r1.<TS>.md`, `qa-gates/ps-temp-file-audit-r1.<TS>.md`, `qa-gates/csharp-not-applicable-r1.<TS>.md` |
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/research/research.2026-10-09T14-10.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/research/research.2026-10-09T14-10.md
new file mode 100644
index 000000000..a4e3e4965
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/research/research.2026-10-09T14-10.md
@@ -0,0 +1,324 @@
+# Research: Dependabot repair for borrowed packages and transitive binding redirects (Issue #985)
+
+- Date: 2026-10-09T14-10
+- Branch: `bug/dependabot-repair-borrowed-packages-and-transitive-redirects-985` (worktree HEAD = main `9911fe138`)
+- Inputs read: `issue.md`, `spec.md` (Draft), `plan.2026-10-09T13-06.md` (template only)
+- Evidence markers: `[V]` verified by reading or searching tracked files in this worktree; `[V-web]` verified from the public GitHub web UI (no `gh` or Bash was available to this agent); `[U]` not verified, stated as a risk.
+
+## 1. Summary of the recommendation
+
+1. **Borrowed hint paths:** declare each borrowed package in the test project's own `packages.config`. On main there are exactly four borrowed (project, package) pairs: QuickFiler.Test with WebView2 and with ObjectListView, UtilitiesCS.Test with WebView2, and TaskTree.Test with ObjectListView. Also delete the duplicate `Microsoft.Web.WebView2.Core` `<Reference>` in `QuickFiler.Test.csproj`. No other csproj edit is required.
+2. **Transitive binding redirects:** add a solution-wide redirect-sync pass in a new module, `scripts/dependencies/BindingRedirectSync.psm1`. The composition root `Repair-PackageManifestConsistency.ps1` calls it unconditionally, so the pass does not depend on `-CandidateUpgrade`. The pass rewrites any `bindingRedirect` whose `newVersion` matches no csproj `<Reference>` version. The target is the sibling project's own reference version if it has one; otherwise it is the highest version referenced anywhere in the solution.
+3. **Gate on main:** add one `It` block to `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`. It calls the existing `Find-OrphanedHintPath` for every project directory and expects 0 findings.
+4. **No workflow change.** `dependabot-repair.yml` checks out the Dependabot branch and runs that branch's copy of the script. An unconditional pass therefore reaches every Dependabot PR after a rebase or recreate, with no YAML diff. A YAML diff would trigger `modified-workflow-needs-green-run`. That rule cannot be satisfied before merge for a `workflow_run`-only workflow.
+5. After merge, comment `@dependabot recreate` on PR #984. `rebase` is not enough: Dependabot refuses to rebase a branch that carries the repair bot's commit.
+
+## 2. Current state analysis
+
+### 2.1 Repair composition root and modules (line counts, last content line) [V]
+
+| File | Lines | Headroom to 500 |
+|---|---|---|
+| `scripts/dependencies/Repair-PackageManifestConsistency.ps1` | 475 | 25 |
+| `scripts/dependencies/ConsistencyVerifier.psm1` | 499 | 1 (full) |
+| `scripts/dependencies/BindingRedirectVerification.psm1` | 139 | 361 |
+| `scripts/dependencies/ProjectConsistency.psm1` | 381 | 119 |
+| `scripts/dependencies/AnalyzerItemRepair.psm1` | 402 | 98 |
+| `scripts/dependencies/PackageGraph.psm1` | 465 | 35 |
+| `tests/scripts/dependencies/Repair-PackageManifestConsistency.Tests.ps1` | 429 | 71 |
+| `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` | 152 | 348 |
+
+### 2.2 How the existing redirect pass works [V]
+
+- `Repair-PackageManifestConsistency.ps1:424-440`: inside the per-manifest loop, the app.config beside the manifest is reconciled only when `@($upgrade.Applied).Count -gt 0` (line 425). `Applied` is populated only by `Invoke-CandidateUpgrade` (lines 154-202), and only for ids in `-CandidateUpgrade`. The workflow passes no candidate (`dependabot-repair.yml:80`), so the pass never runs from `workflow_run`. The workflow comment at lines 87-94 records this.
+- Even when `-CandidateUpgrade` is supplied, the pass covers only an app.config that sits beside a manifest declaring the upgraded package. Its target version comes from `Resolve-ReferenceAssemblyVersion` against that project's own text. A test project that receives log4net only transitively has no manifest entry, so the pass would skip it even with `-CandidateUpgrade` supplied. Supplying `-CandidateUpgrade` from the workflow therefore does not fix the defect.
+- The rewrite primitive `ProjectConsistency.psm1:271-375` (`Invoke-BindingRedirectReconciliation`) is pure over text. It does a regex replace per `<dependentAssembly>` block (byte-exact outside the substituted attributes). It writes the resolved version into the `oldVersion` upper bound, keeping the lower bound, and into `newVersion`. It is reusable as is.
+- `BindingRedirectVerification.psm1` provides `ConvertTo-ReferenceVersionMap` (lines 31-72), which builds a union over every csproj `Reference Include="Name, Version=..."`. It also provides `Find-StaleBindingRedirect` (lines 74-134).
+
+### 2.3 Invariant the pester gate asserts [V]
+
+`tests/scripts/dependencies/BindingRedirectVerification.Tests.ps1`:
+
+- Lines 275-318: over every root-level `*/app.config`, every redirect `newVersion` must be a member of the solution-wide union map from `ConvertTo-ReferenceVersionMap` over every root-level `*/*.csproj`. The expected known-debt set is empty (line 293). The only expected unverifiable name is `netstandard` (line 294). This is the assertion that fails on CI run #1059 with `log4net|3.4.0.0`.
+- Lines 320-369: for 16 named assemblies, `oldVersion` must equal `'0.0.0.0-' + newVersion`, and `newVersion` must be in the map.
+- Lines 246-273: 13 Fizzler redirects at `0.0.0.0-1.3.1.0` / `1.3.1.0`.
+- Property to note: the check is membership in a **union**. A stale `<Reference>` left in a test csproj keeps an old version in the map and hides a stale redirect. This is the case in PR #984 for the WebView2 redirects in QuickFiler.Test and UtilitiesCS.Test (`QuickFiler.Test/app.config:286-287`, `UtilitiesCS.Test/app.config:274-275`, both `1.0.4191.47`). The hint-path fix in section 4.1 removes that masking.
+
+### 2.4 Workflow mechanics that shape the design [V]
+
+- Trigger: `workflow_run` on CI `completed` (lines 19-22). The job checks out `head_branch` (line 58) and runs `"$env:GITHUB_WORKSPACE\scripts\dependencies\Repair-PackageManifestConsistency.ps1"` (line 80). The script that runs is the Dependabot branch's copy. The YAML that runs is the default branch's copy (GitHub `workflow_run` semantics). A script change therefore reaches a Dependabot PR once its branch contains main's commit (rebase or recreate).
+- The commit step stages `git add --update -- '*.csproj' '*/packages.config' '*/app.config'` (line 136), so app.config writes are pushed. The push gate reads `written-count` from `WrittenPath` (lines 106, 112), so a write with no repair record is still pushed.
+- `beyond-known-weak` (line 95) counts `Verification[].Report.Repair` kinds other than `Analyzer`. If the new pass emits records into `Verification[].Report.Repair`, the clause the comment says was removed "becomes load-bearing again" (lines 93-94), which would require a YAML change. The design below keeps the new records in a separate result property, so no YAML change is needed.
+- `modified-workflow-needs-green-run` (`.claude/skills/feature-review-workflow/SKILL.md:68-70`) is Blocking for any diff under `.github/workflows/**`, including `.github/workflows/README.md`. This workflow cannot produce a green run against a feature branch head: it has a `dependabot/` branch filter and no `workflow_dispatch`. Agent memory records the same disposition for issue #952. Conclusion: change no file under `.github/workflows/**`.
+
+### 2.5 Formatting gate [V]
+
+`.csharpierignore:15-18` excludes `**/packages.config` and `**/app.config` (and lines 12-14 exclude `*.csproj/*.props/*.targets`). `_format-check.yml:41` runs `dotnet csharpier check .`, which therefore never inspects these files. Format-check passed on run #1059 [V-web]. That run included a packages.config whose BOM Dependabot had removed. The repository's canonical manifest form is the NuGet inline form enforced by `Invoke-ManifestNormalization` (`PackageGraph.psm1:395-455`, invoked at `Repair-PackageManifestConsistency.ps1:445-447`). The new pass must therefore:
+- rewrite only attribute values inside a matched block (reuse `Invoke-BindingRedirectReconciliation`), leaving line terminators and every other byte unchanged;
+- run before normalization, so that normalization remains the last writer.
+
+The repair writes through `[System.IO.File]::WriteAllText` (line 371), which emits UTF-8 without BOM. Dependabot does the same (BOM removal seen in the PR #984 diff [V-web]). Neither format-check nor hygiene objects (`scripts/hygiene` has no manifest-encoding rule [V]).
+
+## 3. Candidate approaches
+
+### 3.1 Borrowed hint paths
+
+- **Selected: declare in the test project's own `packages.config`, plus a Pester gate.** Dependabot's packages.config updater then updates the test project in the same grouped PR (section 4.1). Separately, `Invoke-ProjectFileRepair` (`Repair-PackageManifestConsistency.ps1:228-246`) already reconciles every HintPath, Import and Error folder segment to the manifest version for every declared package, independently of `-CandidateUpgrade`. That reconciliation acts as a backstop.
+- Rejected: have the repair script synthesize the missing manifest entries automatically. This is more complex, and it repairs after Dependabot has already chosen not to update those projects. Their `<Reference Include ... Version=>` would stay stale, because assemblies not named for the package (`Microsoft.Web.WebView2.Core`) are left alone by `Get-RewrittenReferenceVersionLine` (`ProjectConsistency.psm1:108-122`).
+
+### 3.2 Transitive redirects
+
+- **Selected: an unconditional, solution-wide sync pass in a new module, called from the composition root.**
+- Rejected: pass `-CandidateUpgrade` from the workflow. This needs a YAML change (section 2.4). The existing pass is also sibling-manifest-scoped and would still miss the five transitive configs (section 2.2).
+- Rejected: add log4net to the five test `packages.config` files. This declares packages the projects do not compile against, and each future transitive bump would need another manual edit (for example `Microsoft.Graph.Core`, which 16 app.configs redirect but only 2 projects declare [V]). The issue requires no manual step.
+- Rejected: delete the transitive redirects. This changes runtime binding for the test hosts, and the redirects were curated by issue #973.
+
+## 4. Requirements mapping and design
+
+### 4.1 Declaration edits (question 1)
+
+Enumeration on main (complete over all 18 projects; see Numeric Derivation Evidence):
+
+| Project | Borrowed package (folder) | HintPath lines | Production sibling declaring it |
+|---|---|---|---|
+| QuickFiler.Test | `Microsoft.Web.WebView2.1.0.4191.47` | `QuickFiler.Test.csproj:389`, `:392`, `:530` | `QuickFiler/packages.config:19`, `UtilitiesCS/packages.config:57` |
+| QuickFiler.Test | `ObjectListView.Official.2.9.1` | `QuickFiler.Test.csproj:407` | `QuickFiler/packages.config:22` (and 5 others) |
+| UtilitiesCS.Test | `Microsoft.Web.WebView2.1.0.4191.47` | `UtilitiesCS.Test.csproj:815`, `:818` | `UtilitiesCS/packages.config:57` |
+| TaskTree.Test | `ObjectListView.Official.2.9.1` | `TaskTree.Test.csproj:178` | `TaskTree/packages.config:8` |
+
+Not borrowed (verified): `UtilitiesCS.Test` hint-paths ObjectListView at line 827 and declares it at `UtilitiesCS.Test/packages.config:70`. No project has a borrowed `<Import>`, `<Error>` or `<Analyzer>` element (section 7).
+
+Edits (manifests keep the inline NuGet form, sorted by id, with every entry carrying `targetFramework="net481"`):
+
+- `QuickFiler.Test/packages.config`: insert `  <package id="Microsoft.Web.WebView2" version="1.0.4191.47" targetFramework="net481" />` between line 41 (`Microsoft.TestPlatform.ObjectModel`) and line 42 (`Moq`). Insert `  <package id="ObjectListView.Official" version="2.9.1" targetFramework="net481" />` between line 45 (`MSTest.TestFramework`) and line 46 (`OpenTelemetry`).
+- `UtilitiesCS.Test/packages.config`: insert the WebView2 line between line 63 (`Microsoft.TestPlatform.ObjectModel`) and line 64 (`Mono.Reflection`).
+- `TaskTree.Test/packages.config`: insert the ObjectListView line between line 40 (`MSTest.TestFramework`) and line 41 (`OpenTelemetry`).
+- Version rule: use the version the production sibling declares at the time of the edit (1.0.4191.47 and 2.9.1 on main). A different version would itself produce an orphan at the existing hint paths.
+- `QuickFiler.Test/QuickFiler.Test.csproj`: delete the second `ItemGroup` at lines 528-532, which holds a duplicate `<Reference Include="Microsoft.Web.WebView2.Core, Version=1.0.4191.47 ...">` of line 388. This is the same hand-borrowing defect. The duplicate also makes NuGet's uninstall/reinstall of the Reference non-deterministic. No other csproj edit is needed: the existing HintPaths already name the declared folder and version.
+
+Will Dependabot then update the test projects in the same grouped PR?
+
+- `dependabot.yml:4-5` uses `directories: ["/*"]` with one `all-nuget-updates` group [V].
+- PR #984 changed 53 files: 18 csproj plus the packages.config and app.config of every project that declares a bumped package [V-web]. Examples: `QuickFiler.Test/app.config`'s log4net redirect moved to 3.5.0.0 because QuickFiler.Test declares log4net. Tags.Test does not declare it and was not touched. This shows that Dependabot updates every project directory that declares the dependency.
+- Once WebView2 and ObjectListView are declared in those test projects, they join the group update for those ids. Expected side effects of NuGet's packages.config update in the test projects:
+  - the Reference/HintPath rewrite (seen for production `QuickFiler.csproj` in #984: `processorArchitecture` dropped, `<Private>True</Private>` added) [V-web];
+  - likely an added `Microsoft.Web.WebView2.targets` `<Import>`/`<Error>` and a `Microsoft.Web.WebView2.Wpf` reference [U]. Both are benign for a test project, and the `<Import>` is declared, so the Import gate at `RepositoryTreeConsistency.Tests.ps1:65-90` stays green.
+
+### 4.2 Redirect-sync pass (question 2)
+
+**Placement:** a new module, `scripts/dependencies/BindingRedirectSync.psm1`.
+
+- `ConsistencyVerifier.psm1` is full (499).
+- `ProjectConsistency.psm1` (381) would reach roughly 490 with about 110 lines.
+- `BindingRedirectVerification.psm1` is documented as the detection layer (header lines 6-13), so adding a writer there mixes concerns.
+- The composition root has 25 lines of headroom, so it receives only the call and the result wiring (about 12-15 lines).
+- The new module imports `PackageGraph.psm1`, `BindingRedirectVerification.psm1` and `ProjectConsistency.psm1`, without `-Force`, matching the repo's pattern (`ConsistencyVerifier.psm1:26-31`). None of these imports the new module, so no cycle is created.
+
+**Exported functions (proposed contracts):**
+
+1. `Invoke-BindingRedirectSync -AppConfigText <string> -DeployedVersionProvider <scriptblock> [-PreferredVersionProvider <scriptblock>]`. Pure over text. Returns `BindingRedirectSync.Result` with fields `Text`, `Repair[]` (Kind `BindingRedirectSync`, AssemblyName, From, To, Rule), `Unverifiable[]`, `Unresolvable[]` and `ExaminedCount`. For each record from `ConvertFrom-AppConfigText` with a non-empty `NewVersion`:
+   - `deployed` = distinct non-empty versions from `DeployedVersionProvider`. If the set is empty, add the name to `Unverifiable` and change nothing. This covers `netstandard` and matches `Find-StaleBindingRedirect` semantics.
+   - If `deployed -contains NewVersion`, change nothing. This is the idempotence rule, and it preserves curated ranges such as Fizzler's.
+   - Otherwise, choose the target:
+     - (a) the single version from `PreferredVersionProvider` (the sibling csproj's own `Reference` versions for that name), if exactly one exists and it is in `deployed`;
+     - (b) otherwise, the maximum of `deployed` by `[System.Version]`;
+     - (c) if any candidate fails `[System.Version]::TryParse`, add the name to `Unresolvable` and change nothing.
+   - Rationale for (a) and (b): this mirrors MSBuild ResolveAssemblyReference conflict resolution, where a primary reference wins and otherwise the highest version wins [U: documented MSBuild behaviour, not re-verified in this session].
+   - Apply the chosen target with `Invoke-BindingRedirectReconciliation -AssemblyName -AssemblyVersion`. That sets the `oldVersion` upper bound and `newVersion`, which satisfies both invariants in section 2.3.
+2. `Invoke-SolutionBindingRedirectSync -DirectoryLister -TextReader -TextWriter [-ProjectTextOverride <hashtable>]` with `SupportsShouldProcess`. This mirrors `Invoke-ManifestNormalization`.
+   - Build the map with `ConvertTo-ReferenceVersionMap` over every `*.csproj` path the lister returns, preferring the post-repair text in `-ProjectTextOverride` keyed by path.
+   - For every `Get-PackageManifestPath -Kind AppConfig` path, call 1 with a preferred provider read from the csproj in the same directory.
+   - Write only when the text changed and `ShouldProcess` approves.
+   - Return `ChangedPath[]`, `Repair[]`, `Unverifiable[]`, `Unresolvable[]` and `ExaminedAppConfig`.
+3. `Format-BindingRedirectSyncReport -Repair <object[]>` returns a `## Binding redirects synchronised` block, or an empty string when there are no repairs. This keeps report text out of the 475-line composition root.
+
+**Composition-root changes** (`Repair-PackageManifestConsistency.ps1`):
+
+- `Import-Module` the new module.
+- Inside the main loop, record `$repaired.Text` per project path in a hashtable. This is one line after line 418, so that `-WhatIf` runs see the repaired references.
+- After the loop (after line 441) and before normalization (line 445), call `Invoke-SolutionBindingRedirectSync ... -WhatIf:$WhatIfPreference`. The explicit pass-through is needed for the same module-preference reason as lines 443-444. Add `ChangedPath` to `$written`.
+- Add `RedirectSync` (Repair, Unverifiable, Unresolvable) to the result, and append the formatted block to `Body`.
+- Do **not** add the records to `Verification[].Report.Repair`. That keeps `beyond-known-weak` semantics and the workflow comment at lines 87-94 accurate, so no YAML diff is needed.
+- Unverifiable and Unresolvable names are non-fatal and reported. They do not affect `IsSuccess`, so a push of the other repairs is never blocked. The CI pester gate remains the backstop.
+
+**Relationship to the existing pass:** it complements the existing pass and does not replace it. The existing CandidateUpgrade pass (lines 424-440) uses restored-package identity evidence and still serves local runs that pass `-CandidateUpgrade`. When both run, the existing pass writes first, and the sync pass then finds `newVersion` already in the map and changes nothing. The existing context at `Repair-PackageManifestConsistency.Tests.ps1:140-230` keeps its expectations.
+
+**Idempotence and loop safety:** a second run produces zero writes, because every rewritten `newVersion` is now in the map. This matters because each repair push re-runs CI, which re-fires the workflow.
+
+**Ambiguity cases:**
+- Multiple referenced versions and the stale version not among them: rule (a), then (b).
+- Multiple referenced versions and the current version among them: no change.
+- No referenced version: no change; the name is reported as unverifiable.
+- Unparsable version: no change; the name is reported as unresolvable.
+
+**Expected effect on PR #984 after recreate:**
+- The log4net redirects in Tags.Test, TaskTree.Test, TaskVisualization.Test, ToDoModel.Test and VBFunctions.Test move from `0.0.0.0-3.4.0.0/3.4.0.0` to `0.0.0.0-3.5.0.0/3.5.0.0`. The map after Dependabot's update contains only `3.5.0.0` for log4net: all 11 referencing projects also declare log4net, so Dependabot rewrites every Reference [V: 11 Reference lines, 11 declaring manifests].
+- No other redirect changes. All other bumped assemblies are declared wherever they are redirected, except `Microsoft.Graph.Core`, which #984 does not bump.
+
+### 4.3 Main-branch gate (question 4)
+
+Add one `It` to the `Describe 'Repository tree consistency (issue 929)'` block in `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`:
+
+- Reuse the pair-discovery shape of lines 67-73: every root-level directory with a `packages.config` and exactly one csproj.
+- Call `Find-OrphanedHintPath` (`ConsistencyVerifier.psm1:122-154`) for each pair.
+- Assert that the summed `ExaminedCount` is greater than 0, and that the finding count is 0. List the findings as `<project>: line <n> <PackageFolder>`.
+- The module is already imported at line 5. The file stays near 180 lines.
+
+Pre-fix expectation on main: 7 findings in 3 projects (section 4.1 table). This is the required fail-first regression test. Post-fix expectation: 0. Every other HintPath in the 18 projects names a folder whose `Id.Version` is declared in the same project's manifest (Numeric Derivation Evidence). `Find-OrphanedHintPath` compares `Id + '.' + Version` with `-contains`, which is case-insensitive, so the expectation holds.
+
+### 4.4 Workflow (question 5)
+
+- No change to `.github/workflows/dependabot-repair.yml`. The new pass is unconditional inside the script that the workflow already runs (line 80), and its writes reach the push through `WrittenPath` (lines 106, 112, 136).
+- No change to `_pester.yml`: its `Run.Path` and `CodeCoverage.Path` already cover `tests/scripts/dependencies` and `scripts/dependencies` (lines 41, 45), so the new module and tests are picked up automatically.
+- With no workflow diff, `modified-workflow-needs-green-run` does not fire. Do not edit `.github/workflows/README.md` either: the rule's path pattern covers it. Document the new pass in the module help and in the feature folder.
+
+### 4.5 Error handling and logging
+
+- Pure functions throw only through the parser: `ConvertFrom-AppConfigText` rejects non-configuration text.
+- The I/O wrapper reports skipped names in the result object and emits one `Write-Information` summary line with `-InformationAction Continue`. This follows the precedent at `Repair-PackageManifestConsistency.ps1:95-104`, which explains why the verbose stream is invisible in the workflow.
+
+## 5. Other failure modes in PR #984 (question 6)
+
+| Area | Change in #984 | Status after this fix |
+|---|---|---|
+| WebView2 1.0.4191.47 to 1.0.4258.31 | Production updated; tests borrow 4191.47 | Fixed by 4.1. Dependabot updates the test manifests and csproj. The repair's HintPath reconciliation is a backstop. |
+| log4net 3.4.0 to 3.5.0 | 5 transitive redirects stay at 3.4.0.0 | Fixed by 4.2 |
+| Analyzer `Include` paths (Meziantou 3.0.296, Roslynator 5.0.1, Sonar 10.35, MSTest.Analyzers 4.5.1) | Stale items | Already repaired by the existing pass (fff92fe83) |
+| New analyzer rules in bumped analyzers | Possible new diagnostics | `.editorconfig:27` sets `dotnet_analyzer_diagnostic.severity = suggestion`, so new rules cannot become errors under `/p:TreatWarningsAsErrors=true` (`_build-nullable.yml:62-64`). Exception: `MSTEST0032` is pinned to `warning` (`.editorconfig:29`). If MSTest.Analyzers 4.5.1 widens that rule, build-nullable fails [U]. |
+| MSTest.TestFramework 4.5.1 | Possible new `[Obsolete]` APIs | A compiler `CS0618` warning is not covered by the analyzer default and would fail build-nullable [U] |
+| `processorArchitecture` removed, `<Private>True</Private>` added | Production csproj | Benign. Format-check excludes csproj; the build passed for those projects except the borrowing tests [V-web: only the 4 known jobs failed] |
+| packages.config BOM removed | QuickFiler.Test | Benign; format-check passed on #1059 [V-web] |
+| New WebView2 redirect blocks (QuickFiler app.config) | `0.0.0.0-1.0.4258.31` | Consistent with the new Reference versions; pester gate satisfied |
+| Dropped `<Compile>` items | Not observable: the GitHub diff view did not render 48 of 53 files [V-web] | Unverified [U] |
+
+Mandatory first task for the plan (P0): the orchestrator has `gh`, so run `gh run view 37959420911 --log-failed` and `gh pr diff 984`. Confirm that:
+- (a) the build-analyzers and build-nullable errors are only `CS0012`/`CS0234`/`CS0246` in QuickFiler.Test and UtilitiesCS.Test, with no `CS0618` and no `MSTEST0032`;
+- (b) no `-    <Compile Include=` line appears in the diff;
+- (c) the mstest-coverage failure is only the build cascade.
+
+If any of these fails, add it to scope before planning. The rows marked [U] above become in-scope items.
+
+**`@dependabot recreate`:** this is the right command. `@dependabot rebase` is refused once a non-Dependabot commit (fff92fe83) is on the branch. After recreate:
+1. Dependabot recomputes the group from main, now including the test-project declarations, and pushes.
+2. CI runs. It may fail on the transitive redirects.
+3. `dependabot-repair` runs the branch's script, which is now main's script. It reconciles, syncs the 5 redirects and pushes.
+4. CI re-runs; the expected result is green.
+5. `dependabot-repair` re-fires and writes nothing (idempotent), so no push happens.
+
+The [U] analyzer/obsolete risks above remain until step 4 is observed.
+
+## 6. Testing implications (question 7)
+
+All fixtures are in-memory strings and hashtable stores; no temporary files, as in the existing suites. Tests go in Pester 5 under `tests/scripts/dependencies`, and the toolchain runs through PoshQC MCP: format, then analyze, then test.
+
+- **New `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1`:**
+  - `Invoke-BindingRedirectSync`:
+    - a stale transitive redirect is rewritten in both positions, with the lower bound preserved;
+    - a single-version `oldVersion` is replaced outright;
+    - a current redirect is unchanged and a second pass produces zero repairs (idempotence);
+    - an unknown name is unverifiable and unchanged;
+    - with several deployed versions, the preferred own reference wins;
+    - with several deployed versions and no own reference, the highest `[System.Version]` wins (use `3.10.0.0` vs `3.9.0.0` to prove numeric rather than string ordering);
+    - an unparsable version is unresolvable and unchanged;
+    - a block with no `bindingRedirect` is skipped;
+    - empty text examines 0;
+    - non-configuration text throws;
+    - CRLF bytes outside the substituted span are byte-identical (`-ceq` on the remainder).
+  - `Invoke-SolutionBindingRedirectSync`: two-project store (Prod csproj referencing `log4net, Version=3.5.0.0`; Test directory with only an app.config at 3.4.0.0); the override is preferred over the reader text; `-WhatIf` writes nothing; `ChangedPath` is exact.
+  - `Format-BindingRedirectSyncReport`: empty input gives an empty string; non-empty input gives a heading plus one line per repair.
+- **Composition-root integration:** a new file `Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` keeps the existing test file (429 lines) under 500. It reuses the `Get-RepairFixture` store pattern (`Repair-PackageManifestConsistency.Tests.ps1:86-120`). It asserts that:
+  - a run with no `-CandidateUpgrade` rewrites the transitive redirect;
+  - `WrittenPath` contains the app.config;
+  - `Body` carries the new block;
+  - `Verification[].Report.Repair` has no `BindingRedirectSync` kind;
+  - a second run writes nothing.
+
+  The existing contexts must stay green without edits, notably the agreeing tree (`WrittenPath` 0, line 241), `-WhatIf` (line 277), and the SVGControl-scoped `-WhatIf` run (line 378).
+- **Repository gate:** the new `It` in `RepositoryTreeConsistency.Tests.ps1` (section 4.3). Fail-first evidence: run it before the manifest edits (7 findings), then after (0).
+- **Coverage:** `_pester.yml` enforces line coverage >= 80% over `scripts/dependencies` (line 71); the repo policy target is >= 85%. Target >= 90% line coverage on the new module (new-code rule) and no regression on the changed lines of the composition root.
+
+## 7. Numeric Derivation Evidence
+
+### Claim N1: borrowed HintPath elements on main = 7 lines, in 4 (project, package) pairs, across 3 projects
+
+- **Complete Family:** every `<HintPath>` element in every csproj of `TaskMaster.sln` (18 C# projects, `TaskMaster.sln:6-48`) whose path contains `packages\<Id>.<Version>\`. Each is compared with the `<package id version>` entries of the `packages.config` in the same directory.
+- **Exhaustive Search Scope:** `*/*.csproj` (18 files) and `*/packages.config` (18 files) at the worktree root. A recursive `**/*.csproj` glob returned the same 18. A grep for `<HintPath>` under `packages\` followed by anything other than `lib\` returned no matches, so all package HintPaths are under `lib`.
+- **Inclusion Rules:** a HintPath whose `Id.Version` folder is not exactly declared in the sibling manifest. This mirrors `Find-OrphanedHintPath`.
+- **Exclusion Rules:** HintPaths that do not reference `packages\`, and non-HintPath kinds (covered separately by N1-aux).
+- **Primary Search Strategy:** grep `packages\\[^\\]+\\lib` with `-o` over the test csproj (608 lines) and the production csproj, and grep `id="[^"]+" version="[^"]+"` with `-o` over each manifest. Then a per-project manual set difference.
+- **Primary Member Set:**
+  - QuickFiler.Test: lines 389, 392 and 530 (WebView2 1.0.4191.47); line 407 (ObjectListView 2.9.1)
+  - UtilitiesCS.Test: lines 815 and 818 (WebView2)
+  - TaskTree.Test: line 178 (ObjectListView)
+- **Primary Count:** 7 lines, 4 pairs, 3 projects. The other 6 test projects and all 9 production projects have 0.
+- **Cross-check Search Strategy:** a manifest-side query.
+  - (i) A version-pinned alternation regex over the 53 ids shared by every test csproj. It returned count = 53 in each of the 9 test manifests.
+  - (ii) A grep of the remaining distinctive ids per test manifest (log4net, log4net.Ext.Json, Bcl.TimeProvider, TimeProvider.Testing, Newtonsoft.Json, ExCSS, Svg, Castle.Core, FluentAssertions, Moq, AdapterUtilities, MSTest.TestFramework, WebView2, ObjectListView).
+  - (iii) A targeted grep `packages\\(Microsoft\.Web\.WebView2|ObjectListView\.Official)\.` over `*.Test/*.csproj` (8 lines), against `id="(Microsoft\.Web\.WebView2|ObjectListView\.Official)"` over all manifests (9 declarations; UtilitiesCS.Test is the only test project declaring either id).
+- **Cross-check Member Set:** the 8 lines from (iii) minus `UtilitiesCS.Test:827` (declared) = {QuickFiler.Test 389, 392, 407, 530; UtilitiesCS.Test 815, 818; TaskTree.Test 178}. (i) and (ii) show that every other test HintPath id is declared at its exact version.
+- **Cross-check Count:** 7 lines, 4 pairs, 3 projects.
+- **Member-set Comparison:** identical after normalisation to (project, line, folder).
+- **Limitation:** the cross-check is exhaustive for the 9 test projects. For the 9 production projects it reuses the primary enumeration (manual comparison of each production HintPath list against its manifest), so it is not independent there.
+- **Disposition:** withhold `7` as an approved spec acceptance criterion. State the AC as "the `Find-OrphanedHintPath` gate reports 0 findings over every project". Record the gate's pre-fix output, expected to be 7, as the executable cross-check in `evidence/regression-testing/`.
+
+### Claim N1-aux: no borrowed Import, Error or Analyzer element on main
+
+- Import/Error: 230 matched lines. They reconcile as 202 standard-package lines (MSTest.TestAdapter/TestFramework 4.4.1, Microsoft.Testing.* 2.4.1, Meziantou 3.0.290, ValueTuple 4.6.2), plus 10 `System.Reactive.7.0.0` lines, plus 18 lines for NETStandard.Library, Microsoft.ML, CpuMath, Tesseract and WebView2, all in projects that declare them.
+- Analyzer: 162 items in 17 projects, all matching the six analyzer packages at their declared versions. The count from the version-pinned regex equals the count from an unfiltered `<Analyzer Include=` grep: 162 = 162.
+- Meziantou Import/Error lines: 32 = 16 projects x 2, which is exactly the 16 projects that declare Meziantou.
+
+### Claim N2: transitive log4net redirects that go stale under a log4net bump = 5 app.configs
+
+- **Complete Family:** every `*/app.config` (17 files) carrying a `dependentAssembly` named `log4net`.
+- **Exhaustive Search Scope:** `*/app.config` at the root (17 files).
+- **Inclusion Rules:** the config's sibling project neither declares log4net in `packages.config` nor carries `Reference Include="log4net, Version=..."`.
+- **Exclusion Rules:** configs whose project declares or references log4net, because Dependabot updates those.
+- **Primary Search Strategy:** grep `name="log4net"` over `*/app.config` gives 16 configs. Grep `id="log4net"` over `*/packages.config` gives 11 manifests. Set difference.
+- **Primary Member Set:** {VBFunctions.Test, TaskTree.Test, Tags.Test, TaskVisualization.Test, ToDoModel.Test}
+- **Primary Count:** 5
+- **Cross-check Search Strategy:** grep `Include="log4net, Version=[^,]+` over `*/*.csproj` gives 11 projects. Set difference against the 16 redirecting configs.
+- **Cross-check Member Set:** {VBFunctions.Test, TaskTree.Test, Tags.Test, TaskVisualization.Test, ToDoModel.Test}
+- **Cross-check Count:** 5
+- **Member-set Comparison:** identical. It also matches the issue's list.
+
+## 8. Complete list of production files to change
+
+1. `QuickFiler.Test/packages.config`: add WebView2 1.0.4191.47 and ObjectListView.Official 2.9.1.
+2. `UtilitiesCS.Test/packages.config`: add WebView2 1.0.4191.47.
+3. `TaskTree.Test/packages.config`: add ObjectListView.Official 2.9.1.
+4. `QuickFiler.Test/QuickFiler.Test.csproj`: remove the duplicate WebView2.Core Reference ItemGroup (lines 528-532).
+5. `scripts/dependencies/BindingRedirectSync.psm1`: new.
+6. `scripts/dependencies/Repair-PackageManifestConsistency.ps1`: import the module, call it, wire the result and body (must stay at or under 500 lines; currently 475).
+
+Production PowerShell files: 2 (items 5 and 6). This is within the direct-mode budget of 1-3. Tests:
+- `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (new)
+- `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (new)
+- `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` (one new `It`)
+
+Explicitly unchanged: every file under `.github/**`, `ConsistencyVerifier.psm1` (full), `ProjectConsistency.psm1` and `BindingRedirectVerification.psm1`.
+
+## Automation Feasibility
+
+- **Fully automatic after merge, per Dependabot PR:**
+  - the Dependabot group update now includes the test projects, which declare the packages they compile against;
+  - `dependabot-repair` runs the branch's script, which reconciles analyzer items, HintPaths and the redirect sync, and pushes;
+  - CI re-runs; the repair re-fires with no writes.
+  - No YAML change, secret, label or human edit is involved.
+- **One-time manual action:** a `@dependabot recreate` comment on PR #984 after this fix merges. The orchestrator can post it with `gh pr comment 984 --body "@dependabot recreate"`, so no human is needed. It is required because a branch created before the merge carries the pre-fix script. A future Dependabot PR opened after the merge needs nothing.
+- **Regression prevention:**
+  - the orphaned-HintPath Pester gate fails main if a test project borrows a package again;
+  - the existing redirect invariant (`BindingRedirectVerification.Tests.ps1:275-318`) plus the unconditional sync covers every future transitive redirect, for example `Microsoft.Graph.Core`, which 16 configs redirect but only 2 projects declare.
+- **Residual non-automatable risk:** an upstream package release that introduces a warning-severity compiler diagnostic (`CS0618`) or widens `MSTEST0032` would fail build-nullable. Neither the repair nor this design can fix that automatically. It must be confirmed absent for #984 by the P0 log inspection (section 5) and observed on the recreated PR.
+- **Pre-merge verification limit:** the end-to-end workflow path cannot be exercised before merge (`workflow_run` uses the default-branch YAML, filters on `dependabot/` branches, and has no `workflow_dispatch`). Local evidence is limited to:
+  - the Pester suites;
+  - a `-WhatIf` run of `Repair-PackageManifestConsistency.ps1` against a working copy of PR #984's tree, fetched with `git fetch origin dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9` into a separate worktree. That run should report the 5 log4net redirect changes and zero orphaned HintPaths beyond the borrowed WebView2 entries that predate the declaration.
+
+The post-merge proof is the green CI run on the recreated PR #984.
+
+## Rejected alternatives (brief)
+
+- Supply `-CandidateUpgrade` from the workflow: needs a YAML change that cannot be green-run, and still misses transitive configs.
+- Declare log4net in five test manifests: wrong semantics, and needs a manual edit per future transitive bump.
+- Delete the transitive redirects: changes runtime binding, and undoes issue #973's curation.
+- Auto-synthesise manifest entries for borrowed HintPaths: more complex, and leaves the Reference versions stale.
+- Fail the run on ambiguous redirect versions: blocks unrelated repairs from being pushed; the RAR-equivalent rule plus a report was chosen instead.
diff --git a/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md
new file mode 100644
index 000000000..2845d4e5c
--- /dev/null
+++ b/docs/features/active/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects-985/spec.md
@@ -0,0 +1,217 @@
+# 2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects (Spec)
+
+- **Issue:** #985
+- **Parent (optional):** none
+- **Owner:** drmoisan
+- **Last Updated:** 2026-10-09T14-30
+- **Status:** Draft
+- **Version:** 0.2
+
+## Context
+
+Grouped NuGet Dependabot pull requests (PR #984) still fail CI after the `dependabot-repair` workflow (issue #911) runs successfully, because two classes of manifest inconsistency are invisible to both Dependabot and the repair script:
+
+1. Test projects that hint-path a package they do not declare in their own `packages.config` (borrowed from a sibling production project).
+2. `app.config` binding redirects for assemblies that a project receives only transitively (no `packages.config` entry and no direct `<Reference>`).
+
+All failures must be remediated automatically, with no manual step on any future Dependabot PR.
+
+Environment:
+- OS/version: GitHub Actions `windows-latest` (CI) and Windows 11 (local)
+- Toolchain: PowerShell 7 repair scripts, .NET Framework 4.8.1 / packages.config projects
+- Workflow: `.github/workflows/dependabot-repair.yml` (`workflow_run` trigger) invokes `scripts/dependencies/Repair-PackageManifestConsistency.ps1` without `-CandidateUpgrade`
+- Data source: PR #984 (branch `dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9`); CI run #1059 (run id 37959420911) on repair commit fff92fe83
+
+Impact / Severity:
+- [x] Blocker
+- [ ] High
+- [ ] Medium
+- [ ] Low
+
+## Repro & Evidence
+
+Steps to Reproduce:
+1. Let Dependabot open a grouped NuGet update that bumps Microsoft.Web.WebView2 and log4net (PR #984).
+2. Let `dependabot-repair` run after CI; it repairs `<Analyzer Include>` paths and pushes commit fff92fe83 as `taskmaster-dependabot-repair[bot]`.
+3. Observe CI run #1059 on that commit.
+
+Expected:
+After the repair workflow runs, every required CI check (build-analyzers, build-nullable, mstest-coverage, pester, format-check, actionlint, hygiene) passes on the Dependabot branch with no human edit. Every project that compiles against a package declares that package in its own `packages.config`, and every `bindingRedirect newVersion` equals an assembly version actually referenced in the solution.
+
+Actual:
+- build-analyzers, build-nullable and mstest-coverage fail. `UtilitiesCS.Test` and `QuickFiler.Test` hint-path `packages\Microsoft.Web.WebView2.1.0.4191.47\...` without declaring WebView2 in their own `packages.config`. After the production projects move to 1.0.4258.31 nothing restores 4191.47, producing `CS0012` / `CS0234` / `CS0246` (for example `UtilitiesCS.Test\HelperClasses\ThemeHelpers\ThemeTests.cs(284,29): error CS0012: The type 'WebView2' is defined in an assembly that is not referenced`).
+- The same latent pattern exists on main for `ObjectListView.Official 2.9.1` in `QuickFiler.Test` and `TaskTree.Test`.
+- pester fails. `BindingRedirectVerification.Tests.ps1` reports `log4net|3.4.0.0` because Tags.Test, TaskTree.Test, TaskVisualization.Test, ToDoModel.Test and VBFunctions.Test keep `newVersion="3.4.0.0"` while every other project moved to 3.5.0.0. Those five projects have no log4net `packages.config` entry or `<Reference>`, so neither Dependabot nor the repair script edits them. The repair's redirect pass does not run from the `workflow_run` trigger because `-CandidateUpgrade` is not supplied (see `dependabot-repair.yml` lines 87-94).
+
+Orchestrator verification (2026-10-09, CI run #1059 and the PR #984 diff):
+- The only compiler errors are `CS0234` / `CS0246` / `CS0012` for WebView2 in `QuickFiler.Test` and `UtilitiesCS.Test`. No `MSTEST0032` or `CS0618` diagnostic appears.
+- PR #984 dropped no `<Compile>`, `<EmbeddedResource>` or `<ProjectReference>` items.
+- Pester fails only on the `log4net|3.4.0.0` transitive redirect.
+- The research record's unverified risk rows for analyzer severity, obsolete APIs and dropped `<Compile>` items are therefore closed and out of scope.
+
+Logs / Screenshots:
+- Snippet: `Expected 0, because every bindingRedirect newVersion must equal a csproj Reference version (issue 973 emptied the recorded known-debt set; a new stale pair is fixed, not recorded); observed: log4net|3.4.0.0, but got 1.`
+
+## Scope & Non-Goals
+
+- In scope:
+  - Declare the borrowed packages in the owning test projects' `packages.config` and remove the duplicate WebView2.Core reference in `QuickFiler.Test.csproj`.
+  - Add `scripts/dependencies/BindingRedirectSync.psm1` and wire it into `Repair-PackageManifestConsistency.ps1`.
+  - Add a Pester gate that fails when any project hint-paths a package it does not declare.
+  - Pester coverage for the new module and the wiring, using in-memory fixtures.
+- Out of scope / non-goals:
+  - Any change under `.github/workflows/**`, including `.github/workflows/README.md`. A diff there triggers `modified-workflow-needs-green-run`, which cannot be satisfied for a `workflow_run`-only workflow with a `dependabot/` branch filter and no `workflow_dispatch`.
+  - Supplying `-CandidateUpgrade` from the workflow, declaring log4net in the transitive-only test manifests, deleting transitive redirects, and auto-synthesising manifest entries for borrowed hint paths (all rejected in research section 3).
+  - Edits to `ConsistencyVerifier.psm1`, `ProjectConsistency.psm1` and `BindingRedirectVerification.psm1`.
+  - Mitigating a future upstream package release that introduces a new warning-severity compiler diagnostic.
+- Explicitly excluded systems, integrations, or datasets: GitHub Actions workflow definitions, Dependabot configuration, and production C# source.
+
+## Root Cause Analysis
+
+Dependabot's packages.config updater and `Repair-PackageManifestConsistency.ps1` both act only on packages a project declares in its own `packages.config`. Borrowed hint paths and transitive binding redirects fall outside that set. The verifier (`ConsistencyVerifier.psm1` `Find-OrphanedHintPath`) already detects borrowed hint paths but is not a failing gate on main.
+
+The existing redirect pass in `Repair-PackageManifestConsistency.ps1` runs only when `-CandidateUpgrade` yields applied upgrades, and is scoped to the app.config beside a manifest that declares the upgraded package. It therefore cannot reach a project that receives an assembly only transitively, even if `-CandidateUpgrade` were supplied.
+
+## Proposed Fix
+
+### Design summary (what changes where)
+
+1. Manifest declarations (borrowed packages), each at the version the production sibling declares:
+   - `QuickFiler.Test/packages.config`: `Microsoft.Web.WebView2` and `ObjectListView.Official`.
+   - `UtilitiesCS.Test/packages.config`: `Microsoft.Web.WebView2`.
+   - `TaskTree.Test/packages.config`: `ObjectListView.Official`.
+   - Entries keep the inline NuGet form, sorted by id, with the same `targetFramework` as the sibling entries.
+2. `QuickFiler.Test/QuickFiler.Test.csproj`: delete the second `ItemGroup` holding the duplicate `Microsoft.Web.WebView2.Core` `<Reference>`. Existing HintPaths already name the declared folder and version.
+3. New module `scripts/dependencies/BindingRedirectSync.psm1` (a solution-wide, unconditional redirect-sync pass), called from `Repair-PackageManifestConsistency.ps1`.
+4. New `It` block in `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` that runs `Find-OrphanedHintPath` over every project directory.
+
+### Boundaries and invariants to preserve
+
+- Invariant: after the sync pass, every `bindingRedirect` `newVersion` is a member of the solution-wide csproj `<Reference>` version map, with `oldVersion` equal to a lower bound plus the same upper bound. Fixed-state `app.config` files are rewritten to zero further changes on a second run.
+- The pass is stale-only. A redirect whose `newVersion` already belongs to the deployed version set is never modified, which preserves curated ranges (for example the Fizzler redirects).
+- Rewrites change only attribute values inside a matched `<dependentAssembly>` block, by reusing `Invoke-BindingRedirectReconciliation`. Line terminators and every other byte are unchanged.
+- The sync pass runs after the per-project repair loop and before manifest normalization, so normalization remains the last writer.
+- Sync records are not added to `Verification[].Report.Repair`, so the `beyond-known-weak` semantics and the comment in `dependabot-repair.yml` stay accurate and no YAML change is required.
+- Unverifiable and unresolvable names are non-fatal. They do not affect `IsSuccess`, so other repairs are still pushed. The CI Pester gate is the backstop.
+
+### Dependencies or blocked work
+
+- None blocking. The end-to-end `workflow_run` path cannot be exercised before merge, so the CI-dependent criterion is verified after merge.
+- After merge, `@dependabot recreate` is posted on PR #984. `@dependabot rebase` is refused because a non-Dependabot commit is on the branch.
+
+### Implementation strategy (what changes, not sequencing)
+
+#### Files/modules to change
+
+1. `QuickFiler.Test/packages.config`, `UtilitiesCS.Test/packages.config`, `TaskTree.Test/packages.config`.
+2. `QuickFiler.Test/QuickFiler.Test.csproj`.
+3. `scripts/dependencies/BindingRedirectSync.psm1` (new).
+4. `scripts/dependencies/Repair-PackageManifestConsistency.ps1` (import, call, result and body wiring only).
+5. `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (new).
+6. `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (new; keeps the existing 429-line test file under the file-size limit).
+7. `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` (one new `It`).
+
+#### Functions/classes/CLI commands impacted
+
+New exported functions in `BindingRedirectSync.psm1`:
+
+- `Invoke-BindingRedirectSync -AppConfigText <string> -DeployedVersionProvider <scriptblock> [-PreferredVersionProvider <scriptblock>]`. Pure over text. Returns `Text`, `Repair[]` (Kind `BindingRedirectSync`, AssemblyName, From, To, Rule), `Unverifiable[]`, `Unresolvable[]` and `ExaminedCount`. For each redirect with a non-empty `NewVersion`:
+  - Deployed set empty: the name is added to `Unverifiable`; no change.
+  - Deployed set contains `NewVersion`: no change (idempotence).
+  - Otherwise the target is, in order: (a) the single own-reference version from `PreferredVersionProvider` when exactly one exists and it is in the deployed set; (b) the maximum deployed version by `[System.Version]`; (c) if any candidate fails `[System.Version]::TryParse`, the name is added to `Unresolvable` and nothing changes.
+  - The target is applied with `Invoke-BindingRedirectReconciliation`.
+- `Invoke-SolutionBindingRedirectSync -DirectoryLister -TextReader -TextWriter [-ProjectTextOverride <hashtable>]` with `SupportsShouldProcess`, mirroring `Invoke-ManifestNormalization`. Builds the map with `ConvertTo-ReferenceVersionMap` over every csproj (preferring post-repair text in the override), processes every app.config, and writes only changed text when `ShouldProcess` approves. Returns `ChangedPath[]`, `Repair[]`, `Unverifiable[]`, `Unresolvable[]` and `ExaminedAppConfig`.
+- `Format-BindingRedirectSyncReport -Repair <object[]>`. Returns a `## Binding redirects synchronised` block, or an empty string when there are no repairs.
+
+Composition root changes in `Repair-PackageManifestConsistency.ps1`: import the module without `-Force`; record the repaired text per project path in the main loop; call `Invoke-SolutionBindingRedirectSync` after the loop and before normalization with `-WhatIf:$WhatIfPreference` passed explicitly; add `ChangedPath` to the written set; add a `RedirectSync` result field (Repair, Unverifiable, Unresolvable); append the formatted block to `Body`.
+
+#### Data flow and validation changes
+
+The existing `-CandidateUpgrade` pass keeps its behaviour and writes first when both run. The sync pass then finds `newVersion` already in the map and changes nothing. Written app.config paths reach the workflow's push through `WrittenPath` without YAML edits.
+
+#### Error handling and logging updates
+
+- Pure functions throw only through `ConvertFrom-AppConfigText`, which rejects non-configuration text.
+- The I/O wrapper reports skipped names in the result object and emits one `Write-Information` summary line with `-InformationAction Continue`, following the precedent in the repair script.
+
+#### Rollback/feature-flag considerations
+
+None. The pass is idempotent and reverts by reverting the commit. No flag is introduced.
+
+### Technical specifications (interfaces/contracts)
+
+#### Inputs/outputs and formats
+
+See the function contracts above. The `RedirectSync` result field is additive to the repair script's result object.
+
+#### Required configuration keys and defaults
+
+None.
+
+#### Backward-compatibility expectations
+
+Existing contexts in `Repair-PackageManifestConsistency.Tests.ps1` stay green without edits, notably the agreeing-tree case (no written paths), the `-WhatIf` case and the SVGControl-scoped `-WhatIf` case. `Verification[].Report.Repair` contents are unchanged.
+
+#### Performance constraints (latency/throughput/memory)
+
+None beyond a single additional read of each csproj and app.config in the tree; the pass is text-only.
+
+## Assumptions, Constraints, Dependencies
+
+- Assumptions: MSBuild reference conflict resolution prefers a primary reference and otherwise the highest version; the design mirrors this and this behaviour was not re-verified in research.
+- Constraints:
+  - Every PowerShell file stays within the repository file-size limit; `Repair-PackageManifestConsistency.ps1` has little headroom, so it receives wiring only.
+  - `.csharpierignore` excludes `packages.config`, `app.config` and csproj files, so manifest edits are not checked by format-check; the canonical manifest form is enforced by `Invoke-ManifestNormalization`.
+  - No file under `.github/workflows/**` may change.
+- External dependencies: Dependabot's grouped packages.config update (`dependabot.yml` groups every directory into one group), PoshQC MCP tools for the PowerShell toolchain.
+
+## Data / API / Config Impact
+
+- User-facing or API changes: new `RedirectSync` field in the repair script's result; new `## Binding redirects synchronised` section in the repair body.
+- Data or migration considerations: none. After merge, the five transitive log4net redirects on the Dependabot branch move to the version already referenced elsewhere when the repair re-runs.
+- Logging/telemetry updates: one `Write-Information` summary line from the sync wrapper.
+- Compatibility notes: no CLI flag, config schema or workflow change.
+
+## Test Strategy
+
+All fixtures are in-memory strings and hashtable stores; no temporary files. Tests use Pester 5; the toolchain runs through the PoshQC MCP tools (format, analyze, test).
+
+- `tests/scripts/dependencies/BindingRedirectSync.Tests.ps1` (new):
+  - `Invoke-BindingRedirectSync`: stale transitive redirect rewritten in both positions with the lower bound preserved; single-version `oldVersion` replaced outright; current redirect unchanged and a second pass produces zero repairs; unknown name reported unverifiable and unchanged; several deployed versions with an own reference prefers the own reference; several deployed versions without an own reference selects the highest by `[System.Version]` (use `3.10.0.0` versus `3.9.0.0` to prove numeric rather than string ordering); unparsable version reported unresolvable and unchanged; block without `bindingRedirect` skipped; empty text examines nothing; non-configuration text throws; CRLF bytes outside the substituted span are byte-identical.
+  - `Invoke-SolutionBindingRedirectSync`: a two-project store (production csproj referencing the newer version; test directory with only an app.config at the older version); override text preferred over reader text; `-WhatIf` writes nothing; `ChangedPath` is exact.
+  - `Format-BindingRedirectSyncReport`: empty input gives an empty string; non-empty input gives a heading plus one line per repair.
+- `tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1` (new), reusing the existing fixture-store pattern: a run with no `-CandidateUpgrade` rewrites the transitive redirect; `WrittenPath` contains the app.config; `Body` carries the new block; `Verification[].Report.Repair` has no `BindingRedirectSync` kind; a second run writes nothing.
+- `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1`: new `It` asserting that the examined count is positive and `Find-OrphanedHintPath` reports no findings across every project directory, listing any finding as `<project>: line <n> <PackageFolder>`. Fail-first evidence: run before the manifest edits (findings expected) and after (none), recorded under `evidence/regression-testing/`.
+- Coverage: target at least 90% line coverage on the new module (new-code policy), no regression on changed composition-root lines.
+- Toolchain commands: PoshQC format, then analyze, then test for PowerShell; the repository C# toolchain order from CLAUDE.md (CSharpier, analyzer rebuild, nullable rebuild, MSTest with coverage) because csproj and manifest files change.
+- Manual validation: local integration rehearsal described in the last verification criterion below.
+
+## Acceptance Criteria
+
+Evidence classes: criteria 1 to 5 are verified before merge. Criterion 6 is verification evidence produced locally; it is not a CI dependency. Criterion 7 is CI-dependent (pending-CI) and is checked off after merge. Numeric populations are deliberately not asserted in these criteria; the research record's numeric derivation is not used as an acceptance assertion.
+
+- [x] AC1 Borrowed packages declared: `QuickFiler.Test/packages.config` declares `Microsoft.Web.WebView2` and `ObjectListView.Official`; `UtilitiesCS.Test/packages.config` declares `Microsoft.Web.WebView2`; `TaskTree.Test/packages.config` declares `ObjectListView.Official`. Each entry is at the version the production sibling manifest declares and matches the folder named by the project's existing HintPaths. The duplicate `Microsoft.Web.WebView2.Core` `<Reference>` item group is removed from `QuickFiler.Test/QuickFiler.Test.csproj`, and exactly one reference to that assembly remains there.
+- [x] AC2 `scripts/dependencies/BindingRedirectSync.psm1` exists and exports `Invoke-BindingRedirectSync`, `Invoke-SolutionBindingRedirectSync` and `Format-BindingRedirectSyncReport`. Pester tests pin each of these behaviours: stale-only rewrite (a redirect whose `newVersion` is already a deployed version is left unchanged); target selection prefers the project's own reference version and otherwise the highest version by `[System.Version]` comparison; assemblies with no deployed version, or with an unparsable version, are left unchanged and reported as `Unverifiable` or `Unresolvable`; a second run produces no repairs and no writes (idempotent). `Repair-PackageManifestConsistency.ps1` invokes the pass unconditionally, including when `-CandidateUpgrade` is not supplied, exposes the outcome in a separate `RedirectSync` result field, does not add sync records to `Verification[].Report.Repair`, and remains within the repository file-size limit for production scripts.
+- [x] AC3 Main-branch gate: a Pester `It` in `tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1` asserts that `Find-OrphanedHintPath` reports no findings across all projects on main, and that the examined count is positive so the assertion cannot pass vacuously. The fail-first run (before the manifest edits, findings reported) and the passing run (after) are recorded under `evidence/regression-testing/`.
+- [x] AC4 No file under `.github/workflows/**` is modified by this change, verified by an empty `git diff --name-only` against the merge base filtered to that path.
+- [x] AC5 Pester tests use in-memory fixtures only and create no temporary files. Line coverage of the new module meets the repository new-code coverage target. The full PowerShell toolchain (PoshQC format, analyze, test) passes in a single pass, and the C# toolchain from CLAUDE.md passes in a single pass.
+- [x] AC6 Local integration rehearsal (verification evidence, not a CI dependency): with this fix applied on top of the Dependabot branch of PR #984, running `Repair-PackageManifestConsistency.ps1` followed by NuGet restore and the nullable-gate MSBuild `/t:Rebuild` (with `/p:TreatWarningsAsErrors=true`) and the analyzer-gate MSBuild `/t:Rebuild` all succeed, and the `BindingRedirectVerification` Pester suite passes. The captured build logs and Pester summary are stored under `evidence/` per the evidence conventions, as projections rather than raw TRX or coverage documents.
+- [ ] AC7 Pending-CI: after this change is merged to main and `@dependabot recreate` is commented on PR #984, every required CI check on that PR (build-analyzers, build-nullable, mstest-coverage, pester, format-check, actionlint, hygiene) passes with no human edit after the repair workflow runs, and the repair workflow's re-run after that green CI writes nothing. This criterion is checked off by the item's orchestrator run only after the CI result is observed.
+
+## Risks & Mitigations
+
+- Technical or operational risks:
+  - The end-to-end `workflow_run` path cannot be exercised before merge; AC7 is the only proof of it.
+  - Once WebView2 and ObjectListView are declared in the test projects, Dependabot's update rewrites their references and may add a WebView2 `.targets` import and a Wpf reference (unverified). Both are expected to be benign.
+  - Highest-version target selection is a heuristic when several versions are referenced and the stale one is not among them; unparsable versions are reported, not guessed.
+  - A future upstream release introducing a warning-severity compiler diagnostic would fail the nullable gate, which this fix cannot prevent.
+- Mitigations and rollbacks:
+  - Idempotent pass and a Pester gate that fails main if a test project borrows a package again.
+  - The existing `BindingRedirectVerification` invariant remains the CI backstop for any redirect the pass reports as unverifiable.
+  - Rollback is a revert of the commit; no flag or data migration is involved.
+
+## Rollout & Follow-up
+
+- Release/rollout steps: merge to main; post `@dependabot recreate` on PR #984 (not `rebase`); observe CI, the repair run and the idempotent re-run.
+- Post-fix monitoring or clean-up tasks: confirm the repair run's body lists the synchronised redirects; confirm no new unverifiable names other than the known `netstandard` case.
+- Links: issue #985, PR #984, CI run #1059, issue #911 (repair workflow), issue #973 (redirect curation), research `research/research.2026-10-09T14-10.md`.
diff --git a/docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md b/docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md
new file mode 100644
index 000000000..41f8f92f7
--- /dev/null
+++ b/docs/features/potential/promoted/2026-10-09-dependabot-repair-borrowed-packages-and-transitive-redirects.md
@@ -0,0 +1,66 @@
+# dependabot-repair-borrowed-packages-and-transitive-redirects (Issue #985)
+
+- Date captured: 2026-10-09
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/dependabot-repair-borrowed-packages-and-transitive-redirects/ (Issue #985)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #985
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/985
+- Last Updated: 2026-10-09
+## Summary
+
+Grouped NuGet Dependabot pull requests (PR #984) still fail CI after the `dependabot-repair` workflow (issue #911) runs successfully, because two classes of manifest inconsistency are invisible to both Dependabot and the repair script: (1) test projects that hint-path a package they do not declare in their own `packages.config` (borrowed from a sibling production project), and (2) `app.config` binding redirects for assemblies that a project receives only transitively (no `packages.config` entry and no direct `<Reference>`). All failures must be remediated automatically, with no manual step on any future Dependabot PR.
+
+## Environment
+
+- OS/version: GitHub Actions `windows-latest` (CI) and Windows 11 (local)
+- Python version: n/a (PowerShell 7 repair scripts, .NET Framework 4.8.1 / packages.config projects)
+- Command/flags used: CI workflow `ci.yml` on branch `dependabot/nuget/QuickFiler.Test/all-nuget-updates-2542c001c9`; repair workflow `.github/workflows/dependabot-repair.yml` (workflow_run trigger) invoking `scripts/dependencies/Repair-PackageManifestConsistency.ps1` without `-CandidateUpgrade`
+- Data source or fixture: PR #984 (AngleSharp, log4net 3.4.0 -> 3.5.0, Microsoft.Web.WebView2 1.0.4191.47 -> 1.0.4258.31, analyzer bumps); CI run #1059 (id 37959420911) on repair commit fff92fe83
+
+## Steps to Reproduce
+
+1. Let Dependabot open a grouped NuGet update that bumps Microsoft.Web.WebView2 and log4net (PR #984).
+2. Let `dependabot-repair` run after CI; it repairs `<Analyzer Include>` paths and pushes commit fff92fe83 as `taskmaster-dependabot-repair[bot]`.
+3. Observe CI run #1059 on that commit.
+
+## Expected Behavior
+
+After the repair workflow runs, every required CI check (build-analyzers, build-nullable, mstest-coverage, pester, format-check, actionlint, hygiene) passes on the Dependabot branch with no human edit. Every project that compiles against a package declares that package in its own `packages.config`, and every `bindingRedirect newVersion` equals an assembly version actually referenced in the solution.
+
+## Actual Behavior
+
+- build-analyzers, build-nullable, mstest-coverage fail: `UtilitiesCS.Test` and `QuickFiler.Test` hint-path `packages\Microsoft.Web.WebView2.1.0.4191.47\...` without declaring WebView2 in their own `packages.config`; after the production projects move to 1.0.4258.31 nothing restores 4191.47, producing `CS0012` / `CS0234` / `CS0246` (for example `UtilitiesCS.Test\HelperClasses\ThemeHelpers\ThemeTests.cs(284,29): error CS0012: The type 'WebView2' is defined in an assembly that is not referenced`).
+- The same latent pattern exists on main for `ObjectListView.Official 2.9.1` in `QuickFiler.Test` and `TaskTree.Test`.
+- pester fails: `BindingRedirectVerification.Tests.ps1` reports `log4net|3.4.0.0` because Tags.Test, TaskTree.Test, TaskVisualization.Test, ToDoModel.Test and VBFunctions.Test keep `newVersion="3.4.0.0"` while every other project moved to 3.5.0.0; those five projects have no log4net `packages.config` entry or `<Reference>`, so neither Dependabot nor the repair script edits them, and the repair's redirect pass does not run from the workflow_run trigger because `-CandidateUpgrade` is not supplied (see `dependabot-repair.yml` lines 87-94).
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or screenshot
+- Snippet: `Expected 0, because every bindingRedirect newVersion must equal a csproj Reference version (issue 973 emptied the recorded known-debt set; a new stale pair is fixed, not recorded); observed: log4net|3.4.0.0, but got 1.`
+
+## Impact / Severity
+
+- [x] Blocker
+- [ ] High
+- [ ] Medium
+- [ ] Low
+
+## Suspected Cause / Notes
+
+Dependabot's packages.config updater and `Repair-PackageManifestConsistency.ps1` both act only on packages a project declares in its own `packages.config`. Borrowed hint paths and transitive binding redirects fall outside that set. The verifier (`ConsistencyVerifier.psm1` `Find-OrphanedHintPath`) already detects borrowed hint paths but is not a failing gate on main.
+
+## Proposed Fix / Validation Ideas
+
+- [ ] Declare Microsoft.Web.WebView2 in QuickFiler.Test and UtilitiesCS.Test `packages.config`, and ObjectListView.Official in QuickFiler.Test and TaskTree.Test `packages.config`, at the versions their production siblings declare.
+- [ ] Add a redirect-sync pass to the repair script that sets every `bindingRedirect newVersion` (and the upper bound of `oldVersion`) to the assembly version referenced elsewhere in the solution, covering transitive redirects; run it from the workflow_run trigger.
+- [ ] Make orphaned (borrowed) hint paths a failing check on main (Pester gate) so the pattern cannot recur.
+- [ ] Pester coverage for the new pass with in-memory fixtures (no temp files).
+- [ ] After merge, `@dependabot recreate` on PR #984 and confirm all required checks pass with no human edit.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md b/docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md
new file mode 100644
index 000000000..7090dcd3e
--- /dev/null
+++ b/docs/features/potential/promoted/2026-10-09-dependabot-repair-workflow-comments-predate-redirect-sync.md
@@ -0,0 +1,61 @@
+# dependabot-repair-workflow-comments-predate-redirect-sync (Issue #986)
+
+- Date captured: 2026-10-09
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/dependabot-repair-workflow-comments-predate-redirect-sync/ (Issue #986)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #986
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/986
+- Last Updated: 2026-10-09
+## Summary
+
+The explanatory comments in `.github/workflows/dependabot-repair.yml` (lines 87-105) predate the unconditional binding-redirect sync pass added by issue #985 (`scripts/dependencies/BindingRedirectSync.psm1`). They state that the binding-redirect class is not reachable from the workflow_run trigger and that the app.config reconciliation pass never runs, which is no longer true: the sync pass now rewrites stale transitive redirects on every run and reports through a separate `RedirectSync` field and `WrittenPath`. The behavior is correct; only the comments mislead a reader.
+
+## Environment
+
+- OS/version: GitHub Actions `windows-latest`
+- Python version: n/a
+- Command/flags used: `dependabot-repair.yml` "Repair package manifest consistency" step
+- Data source or fixture: issue #985 code review (`code-review.2026-10-09T14-55.md`, non-blocking item)
+
+## Steps to Reproduce
+
+1. Read `.github/workflows/dependabot-repair.yml` lines 87-105 after issue #985 merges.
+2. Compare with `Repair-PackageManifestConsistency.ps1`, which now invokes the redirect sync pass unconditionally.
+
+## Expected Behavior
+
+The workflow comments describe the current write classes: analyzer repairs (repair records), manifest normalisation, the `-CandidateUpgrade` reconciliation pass (still unreachable from this trigger), and the unconditional redirect sync pass (reported in `RedirectSync`, written files counted by `WrittenPath`, not counted in `beyond-known-weak`).
+
+## Actual Behavior
+
+The comments say the app.config reconciliation pass never runs from this trigger and do not mention the redirect sync pass.
+
+## Logs / Screenshots
+
+- [ ] Attached minimal logs or screenshot
+- Snippet: `# The binding-redirect class is not reachable from the workflow_run trigger`
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [ ] Medium
+- [x] Low
+
+## Suspected Cause / Notes
+
+Issue #985 deliberately excluded `.github/workflows/**` from its write set: the `modified-workflow-needs-green-run` rule cannot be satisfied for this workflow before merge, because it runs only on `dependabot/` branches and has no manual trigger.
+
+## Proposed Fix / Validation Ideas
+
+- [ ] Update the comment block at lines 87-105 to describe the redirect sync pass; comment-only change.
+- [ ] actionlint passes; the green-run requirement is satisfied by the next Dependabot PR's repair run.
+- [ ] Manual verification notes: none.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/scripts/dependencies/BindingRedirectSync.psm1 b/scripts/dependencies/BindingRedirectSync.psm1
new file mode 100644
index 000000000..da6f3f3bb
--- /dev/null
+++ b/scripts/dependencies/BindingRedirectSync.psm1
@@ -0,0 +1,328 @@
+<#
+.SYNOPSIS
+    Synchronises application-configuration binding redirects with the assembly versions the
+    solution's project files reference.
+
+.DESCRIPTION
+    Detection of a stale redirect lives in BindingRedirectVerification.psm1. This module is the
+    writer that keeps every bindingRedirect newVersion inside the solution-wide csproj Reference
+    version map, covering assemblies a project receives only transitively: such a project
+    declares the assembly in neither its manifest nor its project file, so neither the package
+    updater nor the per-manifest repair pass ever edits its redirect (issue #985).
+
+    The pass is stale-only. A redirect whose newVersion is already a deployed version is never
+    modified, which preserves curated ranges. A stale redirect is rewritten to the project's own
+    Reference version when that is unambiguous, and otherwise to the highest deployed version by
+    numeric comparison, mirroring the conflict resolution the build applies. A name with no
+    deployed version is reported as unverifiable, and a name whose deployed versions do not all
+    parse is reported as unresolvable; neither is changed. Rewrites reuse
+    Invoke-BindingRedirectReconciliation, so only attribute values inside the matched block change.
+
+    Exported functions:
+      - Invoke-BindingRedirectSync
+      - Invoke-SolutionBindingRedirectSync
+      - Format-BindingRedirectSyncReport
+#>
+
+Set-StrictMode -Version Latest
+
+<# Imported without the force switch deliberately, as BindingRedirectVerification.psm1 does: a
+   forced nested import removes the module from the whole session before re-importing it, which
+   would strip the parser from a caller that had already imported it. #>
+Import-Module (Join-Path $PSScriptRoot 'PackageGraph.psm1')
+Import-Module (Join-Path $PSScriptRoot 'BindingRedirectVerification.psm1')
+Import-Module (Join-Path $PSScriptRoot 'ProjectConsistency.psm1')
+
+# Separators are built from their character codes rather than written as escaped literals: a
+# doubled backslash can be collapsed in transit and leave a pattern that matches nothing.
+$script:DirectorySeparator = [char]92
+$script:PathSeparator = [char]47
+$script:ExcludedSegment = @('packages', 'bin', 'obj', 'node_modules')
+
+# Private. Emits the distinct non-empty version strings a provider yields for a name, and nothing
+# when no provider was supplied; callers collect the output with @().
+function Get-ProviderVersion {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowNull()][scriptblock]$Provider,
+        [Parameter(Mandatory = $true)][AllowEmptyString()][string]$Name
+    )
+
+    if ($null -eq $Provider) { return }
+    & $Provider $Name | Where-Object { -not [string]::IsNullOrEmpty([string]$_) } |
+        ForEach-Object { [string]$_ } | Select-Object -Unique
+}
+
+# Private. True for a project-file path outside every restore and build output directory, the
+# same exclusion Get-PackageManifestPath applies to manifests.
+function Test-SyncProjectPath {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([Parameter(Mandatory = $true)][string]$Path)
+
+    $extension = [System.IO.Path]::GetExtension($Path)
+    if (-not [string]::Equals($extension, '.csproj', [System.StringComparison]::OrdinalIgnoreCase)) {
+        return $false
+    }
+    $segment = $Path.Replace($script:DirectorySeparator, $script:PathSeparator).Split($script:PathSeparator)
+    if ($segment.Count -lt 2) { return $true }
+    $parent = $segment[0..($segment.Count - 2)]
+    return (@($parent | Where-Object { $script:ExcludedSegment -contains $_ }).Count -eq 0)
+}
+
+# Private. Classifies a rewrite by numeric version comparison so a downward rewrite is visible in
+# the report; an unparsable value or a numerically equal pair yields Unknown.
+function Get-RedirectDirection {
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)][string]$From,
+        [Parameter(Mandatory = $true)][string]$To
+    )
+
+    $fromVersion = $null
+    $toVersion = $null
+    if ([System.Version]::TryParse($From, [ref]$fromVersion) -and [System.Version]::TryParse($To, [ref]$toVersion)) {
+        if ($toVersion -lt $fromVersion) { return 'Downgrade' }
+        if ($toVersion -gt $fromVersion) { return 'Upgrade' }
+    }
+    return 'Unknown'
+}
+
+function Invoke-BindingRedirectSync {
+    <#
+    .SYNOPSIS
+        Rewrites every stale binding redirect in one application configuration to a deployed
+        assembly version.
+    .DESCRIPTION
+        Pure over text. A dependentAssembly block with no bindingRedirect is not examined, and a
+        name already handled in this call, compared case-insensitively, is skipped. Empty or
+        whitespace text examines zero entries; text that is not an application configuration
+        document is rejected by the parser, whose exception propagates.
+    .PARAMETER AppConfigText
+        The application configuration text.
+    .PARAMETER DeployedVersionProvider
+        A delegate taking an assembly name and returning every version the solution's project
+        files reference for it, or nothing when the name is unknown.
+    .PARAMETER PreferredVersionProvider
+        An optional delegate taking an assembly name and returning the versions the sibling
+        project file references for it.
+    .OUTPUTS
+        A BindingRedirectSync.Result carrying the text, the repair records, the unverifiable and
+        unresolvable names and the examined count. Each repair record carries a Direction of
+        Upgrade, Downgrade or Unknown.
+    #>
+    [CmdletBinding()]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string]$AppConfigText,
+
+        [Parameter(Mandatory = $true)]
+        [scriptblock]$DeployedVersionProvider,
+
+        [AllowNull()]
+        [scriptblock]$PreferredVersionProvider = $null
+    )
+
+    $text = $AppConfigText
+    $repair = [System.Collections.Generic.List[pscustomobject]]::new()
+    $unverifiable = [System.Collections.Generic.List[string]]::new()
+    $unresolvable = [System.Collections.Generic.List[string]]::new()
+    # Assembly names bind case-insensitively, so a block differing only in letter case names the same assembly.
+    $handled = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $examined = 0
+
+    if (-not [string]::IsNullOrWhiteSpace($AppConfigText)) {
+        foreach ($record in @(ConvertFrom-AppConfigText -Text $AppConfigText)) {
+            if ([string]::IsNullOrEmpty($record.NewVersion)) { continue }
+            $examined++
+            if (-not $handled.Add($record.Name)) { continue }
+
+            $deployed = @(Get-ProviderVersion -Provider $DeployedVersionProvider -Name $record.Name)
+            if ($deployed.Count -eq 0) { $unverifiable.Add($record.Name); continue }
+            if ($deployed -contains $record.NewVersion) { continue }
+
+            $preferred = @(Get-ProviderVersion -Provider $PreferredVersionProvider -Name $record.Name)
+            if ($preferred.Count -eq 1 -and $deployed -contains $preferred[0]) {
+                $target = $preferred[0]
+                $rule = 'OwnReference'
+            }
+            else {
+                $target = ''
+                $highest = $null
+                $resolvable = $true
+                foreach ($candidate in $deployed) {
+                    $parsed = $null
+                    if (-not [System.Version]::TryParse($candidate, [ref]$parsed)) { $resolvable = $false; break }
+                    if ($null -eq $highest -or $parsed -gt $highest) { $highest = $parsed; $target = $candidate }
+                }
+                if (-not $resolvable) { $unresolvable.Add($record.Name); continue }
+                $rule = 'HighestDeployed'
+            }
+
+            $text = (Invoke-BindingRedirectReconciliation -AppConfigText $text -AssemblyName $record.Name `
+                    -AssemblyVersion $target).Text
+            $repair.Add([pscustomobject]@{
+                    PSTypeName   = 'BindingRedirectSync.Repair'
+                    Kind         = 'BindingRedirectSync'
+                    AssemblyName = $record.Name
+                    From         = $record.NewVersion
+                    To           = $target
+                    Rule         = $rule
+                    Direction    = (Get-RedirectDirection -From $record.NewVersion -To $target)
+                })
+        }
+    }
+
+    return [pscustomobject]@{
+        PSTypeName    = 'BindingRedirectSync.Result'
+        Text          = $text
+        Repair        = $repair.ToArray()
+        Unverifiable  = $unverifiable.ToArray()
+        Unresolvable  = $unresolvable.ToArray()
+        ExaminedCount = $examined
+    }
+}
+
+function Invoke-SolutionBindingRedirectSync {
+    <#
+    .SYNOPSIS
+        Synchronises the binding redirects of every application configuration in a tree with
+        the Reference versions of every project file in it.
+    .DESCRIPTION
+        Discovery, reading and writing are supplied as delegates, as for
+        Invoke-ManifestNormalization, so the pass runs in memory. The deployed-version map is
+        built over every project file; a project text supplied in ProjectTextOverride is used in
+        place of the text the reader returns, which lets a caller that has repaired a project in
+        memory, or in a what-if run, synchronise against the repaired references. Only changed
+        text is written, and only when ShouldProcess approves. Unverifiable and unresolvable
+        names are reported in the result and are not failures.
+    .PARAMETER DirectoryLister
+        A delegate returning candidate paths.
+    .PARAMETER TextReader
+        A delegate taking a path and returning that file's text.
+    .PARAMETER TextWriter
+        A delegate taking a path and the replacement text.
+    .PARAMETER ProjectTextOverride
+        Project-file path to post-repair text. Empty by default.
+    .OUTPUTS
+        A BindingRedirectSync.SolutionResult carrying the changed paths, the repair records, the
+        distinct unverifiable and unresolvable names and the examined application configuration
+        count.
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    [OutputType([pscustomobject])]
+    param(
+        [Parameter(Mandatory = $true)][scriptblock]$DirectoryLister,
+        [Parameter(Mandatory = $true)][scriptblock]$TextReader,
+        [Parameter(Mandatory = $true)][scriptblock]$TextWriter,
+        [ValidateNotNull()][hashtable]$ProjectTextOverride = @{}
+    )
+
+    # The listing is taken once and replayed, so a lister that records its own discovery is
+    # invoked once per pass rather than once per consumer.
+    $listing = @(& $DirectoryLister | Where-Object { $null -ne $_ } | ForEach-Object { [string]$_ })
+    $replay = { $listing }.GetNewClosure()
+
+    $projectPath = @($listing | Where-Object { Test-SyncProjectPath -Path $_ } | Sort-Object)
+    $projectText = @{}
+    foreach ($path in $projectPath) {
+        $projectText[$path] = if ($ProjectTextOverride.ContainsKey($path)) {
+            [string]$ProjectTextOverride[$path]
+        }
+        else {
+            [string](& $TextReader $path)
+        }
+    }
+
+    $map = ConvertTo-ReferenceVersionMap -ProjectText ([string[]]@($projectPath | ForEach-Object { $projectText[$_] }))
+    $deployedProvider = { param($Name) $map[$Name] }.GetNewClosure()
+
+    $changed = [System.Collections.Generic.List[string]]::new()
+    $repair = [System.Collections.Generic.List[pscustomobject]]::new()
+    $unverifiable = [System.Collections.Generic.List[string]]::new()
+    $unresolvable = [System.Collections.Generic.List[string]]::new()
+    $examined = 0
+
+    foreach ($path in @(Get-PackageManifestPath -Kind 'AppConfig' -DirectoryLister $replay)) {
+        $examined++
+        $directory = Split-Path -Parent $path
+        $sibling = @($projectPath | Where-Object { (Split-Path -Parent $_) -eq $directory })
+        $ownMap = if ($sibling.Count -gt 0) {
+            ConvertTo-ReferenceVersionMap -ProjectText ([string[]]@($sibling | ForEach-Object { $projectText[$_] }))
+        }
+        else {
+            @{}
+        }
+        $preferredProvider = { param($Name) $ownMap[$Name] }.GetNewClosure()
+
+        $original = [string](& $TextReader $path)
+        $result = Invoke-BindingRedirectSync -AppConfigText $original -DeployedVersionProvider $deployedProvider `
+            -PreferredVersionProvider $preferredProvider
+        $projectDirectory = Split-Path -Leaf $directory
+        foreach ($record in @($result.Repair)) {
+            $record | Add-Member -NotePropertyName 'Path' -NotePropertyValue $path
+            $record | Add-Member -NotePropertyName 'ProjectDirectory' -NotePropertyValue $projectDirectory
+            $repair.Add($record)
+        }
+        foreach ($name in @($result.Unverifiable)) { $unverifiable.Add($name) }
+        foreach ($name in @($result.Unresolvable)) { $unresolvable.Add($name) }
+
+        if ($result.Text -cne $original -and $PSCmdlet.ShouldProcess($path, 'Synchronise binding redirects')) {
+            & $TextWriter $path $result.Text
+            $changed.Add($path)
+        }
+    }
+
+    $distinctUnverifiable = [string[]]@($unverifiable | Sort-Object -Unique)
+    $distinctUnresolvable = [string[]]@($unresolvable | Sort-Object -Unique)
+    $summary = 'Binding redirect sync: examined {0} application configuration file(s), synchronised {1} redirect(s), unverifiable {2}, unresolvable {3}'
+    Write-Information ($summary -f $examined, $repair.Count, $distinctUnverifiable.Count, $distinctUnresolvable.Count) `
+        -InformationAction Continue
+
+    return [pscustomobject]@{
+        PSTypeName        = 'BindingRedirectSync.SolutionResult'
+        ChangedPath       = $changed.ToArray()
+        Repair            = $repair.ToArray()
+        Unverifiable      = $distinctUnverifiable
+        Unresolvable      = $distinctUnresolvable
+        ExaminedAppConfig = $examined
+    }
+}
+
+function Format-BindingRedirectSyncReport {
+    <#
+    .SYNOPSIS
+        Renders the synchronised redirects as the disclosure block the pull-request body carries.
+    .PARAMETER Repair
+        The repair records Invoke-SolutionBindingRedirectSync returned.
+    .OUTPUTS
+        The block text, or an empty string when there are no repairs. Each line ends with the
+        rule and the direction of the rewrite.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$Repair
+    )
+
+    if (@($Repair).Count -eq 0) { return '' }
+    $line = [System.Collections.Generic.List[string]]::new()
+    $line.Add('## Binding redirects synchronised')
+    foreach ($record in $Repair) {
+        $line.Add(('- {0}: {1} {2} to {3} ({4}, {5})' -f $record.ProjectDirectory, $record.AssemblyName,
+                $record.From, $record.To, $record.Rule, $record.Direction))
+    }
+    return ($line -join [System.Environment]::NewLine)
+}
+
+Export-ModuleMember -Function @(
+    'Invoke-BindingRedirectSync',
+    'Invoke-SolutionBindingRedirectSync',
+    'Format-BindingRedirectSyncReport'
+)
diff --git a/scripts/dependencies/Repair-PackageManifestConsistency.ps1 b/scripts/dependencies/Repair-PackageManifestConsistency.ps1
index 6d13903d5..1f269b57f 100644
--- a/scripts/dependencies/Repair-PackageManifestConsistency.ps1
+++ b/scripts/dependencies/Repair-PackageManifestConsistency.ps1
@@ -10,7 +10,8 @@
     whole pipeline be driven over an in-memory fixture with no temporary file. The passes run in
     the order in which each consumes the previous one's output: asset-level compatibility gate over
     the candidate upgrades; version reconciliation; analyzer-item regeneration; binding-redirect
-    reconciliation; normalisation; verification. An incompatible package is skipped with a recorded
+    reconciliation; solution-wide binding-redirect synchronisation, which runs on every invocation
+    (issue #985); normalisation; verification. An incompatible package is skipped with a recorded
     reason and the remaining upgrades proceed, so a skip is never a run failure.
 
     Two resolution rules confirm rather than select, because this script can observe what a
@@ -69,6 +70,7 @@ Import-Module (Join-Path $PSScriptRoot 'PackageCompatibility.psm1')
 Import-Module (Join-Path $PSScriptRoot 'AnalyzerItemRepair.psm1')
 Import-Module (Join-Path $PSScriptRoot 'ProjectConsistency.psm1')
 Import-Module (Join-Path $PSScriptRoot 'ConsistencyVerifier.psm1')
+Import-Module (Join-Path $PSScriptRoot 'BindingRedirectSync.psm1')
 
 # Separators are built from their character codes rather than written as escaped literals: a
 # doubled backslash can be collapsed in transit and leave a pattern that matches nothing.
@@ -380,6 +382,7 @@ $verification = [System.Collections.Generic.List[pscustomobject]]::new()
 $skipped = [System.Collections.Generic.List[pscustomobject]]::new()
 $upgraded = [System.Collections.Generic.List[pscustomobject]]::new()
 $written = [System.Collections.Generic.List[string]]::new()
+$projectTextOverride = @{}
 
 foreach ($manifest in @(Get-PackageManifestPath -Kind 'PackagesConfig' -DirectoryLister $lister)) {
     $directory = Split-Path -Parent $manifest
@@ -415,6 +418,7 @@ foreach ($manifest in @(Get-PackageManifestPath -Kind 'PackagesConfig' -Director
         & $writer $project[0] $repaired.Text
         $written.Add($project[0])
     }
+    $projectTextOverride[$project[0]] = $repaired.Text
 
     $verification.Add((Get-ProjectVerification -ProjectName $projectName -ProjectText $repaired.Text `
                 -ManifestText $manifestText -Repair @($repaired.Repair) `
@@ -440,6 +444,12 @@ foreach ($manifest in @(Get-PackageManifestPath -Kind 'PackagesConfig' -Director
     }
 }
 
+# The redirect sync runs on every invocation, with or without -CandidateUpgrade, and before
+# normalisation so normalisation stays the last writer; -WhatIf is passed for the reason below.
+$redirectSync = Invoke-SolutionBindingRedirectSync -DirectoryLister $lister -TextReader $reader `
+    -TextWriter $writer -ProjectTextOverride $projectTextOverride -WhatIf:$WhatIfPreference
+foreach ($path in @($redirectSync.ChangedPath)) { $written.Add($path) }
+
 # -WhatIf is passed explicitly: a preference variable set on this script does not reach a module's
 # own session state, so a normalisation called without it writes during a what-if run.
 $normalisation = Invoke-ManifestNormalization -DirectoryLister $lister -TextReader $reader `
@@ -450,6 +460,11 @@ foreach ($path in @($normalisation.ChangedPath)) { $written.Add($path) }
 # aggregate reads from the same source the per-project report already published.
 $total = { param($Selector) [int](@($verification | ForEach-Object $Selector | Measure-Object -Sum).Sum) }
 $failure = @($verification | ForEach-Object { $_.Failure } | Where-Object { $null -ne $_ })
+$body = & $script:ReportBody $verification.ToArray() $skipped.ToArray()
+$syncReport = Format-BindingRedirectSyncReport -Repair @($redirectSync.Repair)
+if ($syncReport) { $body = $body + [System.Environment]::NewLine + [System.Environment]::NewLine + $syncReport }
+# A file rewritten by more than one pass is listed once; Windows paths compare case-insensitively.
+$distinctWritten = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
 
 [pscustomobject]@{
     PSTypeName                = 'Repair.Result'
@@ -458,7 +473,7 @@ $failure = @($verification | ForEach-Object { $_.Failure } | Where-Object { $nul
     Verification              = $verification.ToArray()
     Skipped                   = $skipped.ToArray()
     Upgraded                  = $upgraded.ToArray()
-    WrittenPath               = $written.ToArray()
+    WrittenPath               = [string[]]@($written | Where-Object { $distinctWritten.Add($_) })
     RepairCount               = (& $total { $_.Report.RepairCount })
     ExaminedProjectCount      = $verification.Count
     ExaminedElementCount      = (& $total { $_.Report.Examined.Total })
@@ -471,5 +486,10 @@ $failure = @($verification | ForEach-Object { $_.Failure } | Where-Object { $nul
     ExaminedManifestCount     = $normalisation.ExaminedPackagesConfig
     ExaminedAppConfigCount    = $normalisation.ExaminedAppConfig
     Failure                   = $failure
-    Body                      = (& $script:ReportBody $verification.ToArray() $skipped.ToArray())
+    RedirectSync              = [pscustomobject]@{
+        Repair       = @($redirectSync.Repair)
+        Unverifiable = @($redirectSync.Unverifiable)
+        Unresolvable = @($redirectSync.Unresolvable)
+    }
+    Body                      = $body
 }
diff --git a/tests/scripts/dependencies/BindingRedirectSync.Tests.ps1 b/tests/scripts/dependencies/BindingRedirectSync.Tests.ps1
new file mode 100644
index 000000000..d788259bc
--- /dev/null
+++ b/tests/scripts/dependencies/BindingRedirectSync.Tests.ps1
@@ -0,0 +1,440 @@
+Set-StrictMode -Version Latest
+
+BeforeAll {
+    $script:RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../../..')).Path
+    Import-Module (Join-Path $script:RepoRoot 'scripts/dependencies/BindingRedirectSync.psm1') -Force
+
+    # Every fixture is an in-memory string or hashtable store; nothing on disk is read except the
+    # module itself and nothing is written. No block or test name in this file matches the regex
+    # AC followed by a digit.
+
+    function Get-AppConfigText {
+        <#
+        .SYNOPSIS
+            Renders an application configuration with one dependentAssembly block per entry,
+            each entry being a name, an oldVersion and a newVersion, with CRLF line endings.
+        #>
+        param([Parameter(Mandatory = $true)][object[]]$Redirect)
+
+        $block = foreach ($entry in $Redirect) {
+            '      <dependentAssembly>'
+            '        <assemblyIdentity name="' + $entry[0] + '" publicKeyToken="0123456789abcdef" culture="neutral" />'
+            '        <bindingRedirect oldVersion="' + $entry[1] + '" newVersion="' + $entry[2] + '" />'
+            '      </dependentAssembly>'
+        }
+        $line = @('<?xml version="1.0" encoding="utf-8"?>', '<configuration>', '  <runtime>',
+            '    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">') + @($block) +
+        @('    </assemblyBinding>', '  </runtime>', '</configuration>')
+        return ($line -join "`r`n")
+    }
+
+    function Get-VersionProvider {
+        <#
+        .SYNOPSIS
+            Returns a delegate that looks an assembly name up in the supplied map.
+        #>
+        param([Parameter(Mandatory = $true)][hashtable]$Map)
+
+        $lookup = $Map
+        return { param($Name) $lookup[$Name] }.GetNewClosure()
+    }
+
+    function Get-ProjectText {
+        <#
+        .SYNOPSIS
+            Renders a project file referencing log4net at the given assembly version.
+        #>
+        param([Parameter(Mandatory = $true)][string]$Version)
+
+        $line = @('<?xml version="1.0" encoding="utf-8"?>', '<Project ToolsVersion="15.0">', '  <ItemGroup>',
+            ('    <Reference Include="log4net, Version=' + $Version + ', Culture=neutral, PublicKeyToken=669e0ddf0bb1aa2a, processorArchitecture=MSIL">'),
+            '      <HintPath>..\packages\log4net.3.5.0\lib\net462\log4net.dll</HintPath>',
+            '    </Reference>', '  </ItemGroup>', '</Project>')
+        return ($line -join "`r`n")
+    }
+
+    function Get-SolutionStore {
+        <#
+        .SYNOPSIS
+            Builds the two-project store: Prod references log4net 3.5.0.0 and redirects to it;
+            Test carries only an application configuration redirecting log4net to 3.4.0.0. A
+            project file under a restore directory, referencing 3.4.0.0, must be ignored.
+        #>
+        return @{
+            'X:\fixture\Prod\Prod.csproj'                       = (Get-ProjectText -Version '3.5.0.0')
+            'X:\fixture\Prod\app.config'                        = (Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.5.0.0', '3.5.0.0')))
+            'X:\fixture\Test\app.config'                        = (Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0')))
+            'X:\fixture\packages\log4net.3.4.0\Restored.csproj' = (Get-ProjectText -Version '3.4.0.0')
+            'X:\fixture\readme.txt'                             = 'not a project'
+        }
+    }
+
+    function Get-StoreDelegate {
+        <#
+        .SYNOPSIS
+            Returns the lister, reader and writer delegates over an in-memory store.
+        #>
+        param([Parameter(Mandatory = $true)][hashtable]$Store)
+
+        $file = $Store
+        return @{
+            DirectoryLister = { @($file.Keys) }.GetNewClosure()
+            TextReader      = { param($Path) [string]$file[$Path] }.GetNewClosure()
+            TextWriter      = { param($Path, $Text) $file[$Path] = $Text }.GetNewClosure()
+        }
+    }
+}
+
+Describe 'Invoke-BindingRedirectSync (in-memory fixtures)' {
+
+    It 'rewrites a stale redirect in both positions and keeps the oldVersion lower bound' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '1.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Text | Should -Match 'oldVersion="1\.0\.0\.0-3\.5\.0\.0"'
+        $result.Text | Should -Match 'newVersion="3\.5\.0\.0"'
+        @($result.Repair).Count | Should -Be 1
+        $result.Repair[0].Kind | Should -Be 'BindingRedirectSync'
+        $result.Repair[0].From | Should -Be '3.4.0.0'
+        $result.Repair[0].To | Should -Be '3.5.0.0'
+        $result.ExaminedCount | Should -Be 1
+    }
+
+    It 'replaces a single-version oldVersion outright' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Text | Should -Match 'oldVersion="3\.5\.0\.0"'
+        $result.Text | Should -Match 'newVersion="3\.5\.0\.0"'
+    }
+
+    It 'leaves a redirect whose newVersion is already deployed unchanged and reports no repair on a second pass' {
+        # Arrange
+        $current = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.5.0.0', '3.5.0.0'))
+        $stale = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $unchanged = Invoke-BindingRedirectSync -AppConfigText $current -DeployedVersionProvider $deployed
+        $first = Invoke-BindingRedirectSync -AppConfigText $stale -DeployedVersionProvider $deployed
+        $second = Invoke-BindingRedirectSync -AppConfigText $first.Text -DeployedVersionProvider $deployed
+
+        # Assert
+        $unchanged.Text | Should -BeExactly $current
+        @($unchanged.Repair).Count | Should -Be 0
+        @($first.Repair).Count | Should -Be 1
+        @($second.Repair).Count | Should -Be 0 -Because 'a synchronised redirect names a deployed version'
+        $second.Text | Should -BeExactly $first.Text
+    }
+
+    It 'reports an assembly with no deployed version as unverifiable and leaves it unchanged' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('netstandard', '0.0.0.0-2.0.0.0', '2.0.0.0'))
+        $deployed = Get-VersionProvider -Map @{}
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Text | Should -BeExactly $text
+        @($result.Unverifiable) | Should -Be @('netstandard')
+        @($result.Repair).Count | Should -Be 0
+    }
+
+    It 'prefers the project own reference version when several versions are deployed' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.3.0.0', '3.3.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.4.0.0', '3.5.0.0') }
+        $preferred = Get-VersionProvider -Map @{ 'log4net' = @('3.4.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed `
+            -PreferredVersionProvider $preferred
+
+        # Assert
+        $result.Text | Should -Match 'newVersion="3\.4\.0\.0"'
+        $result.Repair[0].To | Should -Be '3.4.0.0'
+        $result.Repair[0].Rule | Should -Be 'OwnReference'
+    }
+
+    It 'selects the highest deployed version by numeric comparison when no own reference exists' {
+        # Arrange: string ordering would select 3.9.0.0; numeric ordering selects 3.10.0.0.
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.8.0.0', '3.8.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.9.0.0', '3.10.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Text | Should -Match 'newVersion="3\.10\.0\.0"'
+        $result.Repair[0].To | Should -Be '3.10.0.0'
+        $result.Repair[0].Rule | Should -Be 'HighestDeployed'
+    }
+
+    It 'falls back to the highest deployed version when the own reference names more than one version' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.3.0.0', '3.3.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.4.0.0', '3.5.0.0') }
+        $preferred = Get-VersionProvider -Map @{ 'log4net' = @('3.4.0.0', '3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed `
+            -PreferredVersionProvider $preferred
+
+        # Assert
+        $result.Repair[0].To | Should -Be '3.5.0.0'
+        $result.Repair[0].Rule | Should -Be 'HighestDeployed'
+    }
+
+    It 'reports an unparsable deployed version as unresolvable and leaves the redirect unchanged' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0', 'not-a-version') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Text | Should -BeExactly $text
+        @($result.Unresolvable) | Should -Be @('log4net')
+        @($result.Repair).Count | Should -Be 0
+    }
+
+    It 'skips a dependentAssembly block that carries no bindingRedirect' {
+        # Arrange: one block with a codeBase only, one stale redirect.
+        $codeBase = @('<?xml version="1.0" encoding="utf-8"?>', '<configuration>', '  <runtime>',
+            '    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">',
+            '      <dependentAssembly>',
+            '        <assemblyIdentity name="Contoso" publicKeyToken="0123456789abcdef" culture="neutral" />',
+            '        <codeBase version="1.0.0.0" href="Contoso.dll" />',
+            '      </dependentAssembly>',
+            '    </assemblyBinding>', '  </runtime>', '</configuration>') -join "`r`n"
+        $deployed = Get-VersionProvider -Map @{ 'Contoso' = @('2.0.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $codeBase -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.ExaminedCount | Should -Be 0
+        $result.Text | Should -BeExactly $codeBase
+        @($result.Repair).Count | Should -Be 0
+    }
+
+    It 'examines zero entries and changes nothing for empty text' {
+        # Arrange
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText '' -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.ExaminedCount | Should -Be 0
+        $result.Text | Should -BeExactly ''
+        @($result.Repair).Count | Should -Be 0
+    }
+
+    It 'throws when the text is not an application configuration document' {
+        # Arrange
+        $deployed = Get-VersionProvider -Map @{}
+
+        # Act / Assert
+        { Invoke-BindingRedirectSync -AppConfigText '<packages />' -DeployedVersionProvider $deployed } |
+            Should -Throw -ExpectedMessage '*not an application configuration document*'
+    }
+
+    It 'keeps every byte outside the substituted attribute values identical in CRLF text' {
+        # Arrange: a current redirect beside the stale one, so untouched blocks are in the span.
+        $text = Get-AppConfigText -Redirect @(
+            @('Fabrikam.Core', '0.0.0.0-1.0.0.0', '1.0.0.0'),
+            @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0'); 'Fabrikam.Core' = @('1.0.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+        $restored = $result.Text.Replace('oldVersion="0.0.0.0-3.5.0.0"', 'oldVersion="0.0.0.0-3.4.0.0"')
+        $restored = $restored.Replace('newVersion="3.5.0.0"', 'newVersion="3.4.0.0"')
+
+        # Assert
+        $result.Text | Should -Not -BeExactly $text
+        ($restored -ceq $text) | Should -BeTrue -Because 'only the two attribute values may differ'
+    }
+
+    It 'marks a rewrite to a higher version as an upgrade' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Repair[0].Direction | Should -BeExactly 'Upgrade'
+    }
+
+    It 'marks a rewrite to a lower version as a downgrade' {
+        # Arrange: the stale newVersion is higher than every deployed version.
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.6.0.0', '3.6.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Repair[0].To | Should -Be '3.5.0.0'
+        $result.Repair[0].Rule | Should -Be 'HighestDeployed'
+        $result.Repair[0].Direction | Should -BeExactly 'Downgrade'
+        $result.Text | Should -Match 'newVersion="3\.5\.0\.0"'
+    }
+
+    It 'marks the direction unknown when the stale version does not parse' {
+        # Arrange
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.4.0.0', 'latest'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Repair[0].To | Should -Be '3.5.0.0'
+        $result.Repair[0].Direction | Should -BeExactly 'Unknown'
+    }
+
+    It 'marks the direction unknown when the two versions are numerically equal' {
+        # Arrange: 3.05.0.0 and 3.5.0.0 differ as text but parse to the same version.
+        $text = Get-AppConfigText -Redirect @(, @('log4net', '0.0.0.0-3.05.0.0', '3.05.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        $result.Repair[0].To | Should -Be '3.5.0.0'
+        $result.Repair[0].Direction | Should -BeExactly 'Unknown'
+    }
+
+    It 'processes an assembly name once when two blocks differ only in letter case' {
+        # Arrange: a PowerShell hashtable literal looks keys up case-insensitively, so the
+        # deployed provider answers for both spellings of the name.
+        $text = Get-AppConfigText -Redirect @(
+            @('log4net', '0.0.0.0-3.4.0.0', '3.4.0.0'),
+            @('Log4Net', '0.0.0.0-3.4.0.0', '3.4.0.0'))
+        $deployed = Get-VersionProvider -Map @{ 'log4net' = @('3.5.0.0') }
+
+        # Act
+        $result = Invoke-BindingRedirectSync -AppConfigText $text -DeployedVersionProvider $deployed
+
+        # Assert
+        @($result.Repair).Count | Should -Be 1
+        $result.ExaminedCount | Should -Be 2
+        [regex]::Matches($result.Text, 'newVersion="3\.5\.0\.0"').Count | Should -Be 2
+    }
+}
+
+Describe 'Invoke-SolutionBindingRedirectSync (in-memory store)' {
+
+    It 'synchronises the transitive redirect of a project that does not reference the assembly' {
+        # Arrange
+        $store = Get-SolutionStore
+        $delegate = Get-StoreDelegate -Store $store
+
+        # Act
+        $result = Invoke-SolutionBindingRedirectSync @delegate
+
+        # Assert
+        $store['X:\fixture\Test\app.config'] | Should -Match 'oldVersion="0\.0\.0\.0-3\.5\.0\.0" newVersion="3\.5\.0\.0"'
+        @($result.Repair).Count | Should -Be 1
+        $result.Repair[0].ProjectDirectory | Should -Be 'Test'
+        $result.Repair[0].Path | Should -Be 'X:\fixture\Test\app.config'
+        $result.Repair[0].Rule | Should -Be 'HighestDeployed'
+        $result.ExaminedAppConfig | Should -Be 2
+    }
+
+    It 'prefers the project text override over the text the reader returns' {
+        # Arrange
+        $store = Get-SolutionStore
+        $delegate = Get-StoreDelegate -Store $store
+        $override = @{ 'X:\fixture\Prod\Prod.csproj' = (Get-ProjectText -Version '3.6.0.0') }
+
+        # Act
+        $result = Invoke-SolutionBindingRedirectSync @delegate -ProjectTextOverride $override
+
+        # Assert
+        $store['X:\fixture\Test\app.config'] | Should -Match 'newVersion="3\.6\.0\.0"'
+        $store['X:\fixture\Prod\app.config'] | Should -Match 'newVersion="3\.6\.0\.0"'
+        @($result.Repair | Where-Object { $_.ProjectDirectory -eq 'Prod' })[0].Rule | Should -Be 'OwnReference'
+    }
+
+    It 'writes nothing when run with -WhatIf' {
+        # Arrange
+        $store = Get-SolutionStore
+        $before = $store['X:\fixture\Test\app.config']
+        $delegate = Get-StoreDelegate -Store $store
+
+        # Act
+        $result = Invoke-SolutionBindingRedirectSync @delegate -WhatIf
+
+        # Assert
+        $store['X:\fixture\Test\app.config'] | Should -BeExactly $before
+        @($result.ChangedPath).Count | Should -Be 0
+    }
+
+    It 'reports exactly the changed application configuration paths' {
+        # Arrange
+        $store = Get-SolutionStore
+        $delegate = Get-StoreDelegate -Store $store
+
+        # Act
+        $result = Invoke-SolutionBindingRedirectSync @delegate
+
+        # Assert
+        @($result.ChangedPath) | Should -Be @('X:\fixture\Test\app.config')
+        @($result.ChangedPath) | Should -Not -Contain 'X:\fixture\Prod\app.config'
+        @($result.Unverifiable).Count | Should -Be 0
+        @($result.Unresolvable).Count | Should -Be 0
+    }
+}
+
+Describe 'Format-BindingRedirectSyncReport' {
+
+    It 'returns an empty string when there are no repairs' {
+        Format-BindingRedirectSyncReport -Repair @() | Should -BeExactly ''
+    }
+
+    It 'returns the heading and one line per repair' {
+        # Arrange
+        $repair = @(
+            [pscustomobject]@{ ProjectDirectory = 'Tags.Test'; AssemblyName = 'log4net'; From = '3.4.0.0'; To = '3.5.0.0'; Rule = 'HighestDeployed'; Direction = 'Upgrade' },
+            [pscustomobject]@{ ProjectDirectory = 'Prod'; AssemblyName = 'Contoso'; From = '1.0.0.0'; To = '2.0.0.0'; Rule = 'OwnReference'; Direction = 'Upgrade' })
+
+        # Act
+        $line = (Format-BindingRedirectSyncReport -Repair $repair) -split [regex]::Escape([System.Environment]::NewLine)
+
+        # Assert
+        $line.Count | Should -Be 3
+        $line[0] | Should -BeExactly '## Binding redirects synchronised'
+        $line[1] | Should -BeExactly '- Tags.Test: log4net 3.4.0.0 to 3.5.0.0 (HighestDeployed, Upgrade)'
+        $line[2] | Should -BeExactly '- Prod: Contoso 1.0.0.0 to 2.0.0.0 (OwnReference, Upgrade)'
+    }
+
+    It 'states a downgrade in the report line' {
+        # Arrange
+        $repair = @(
+            [pscustomobject]@{ ProjectDirectory = 'Tags.Test'; AssemblyName = 'log4net'; From = '3.6.0.0'; To = '3.5.0.0'; Rule = 'HighestDeployed'; Direction = 'Downgrade' })
+
+        # Act
+        $line = (Format-BindingRedirectSyncReport -Repair $repair) -split [regex]::Escape([System.Environment]::NewLine)
+
+        # Assert
+        $line[1] | Should -BeExactly '- Tags.Test: log4net 3.6.0.0 to 3.5.0.0 (HighestDeployed, Downgrade)'
+    }
+}
diff --git a/tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1 b/tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1
new file mode 100644
index 000000000..b95cd3158
--- /dev/null
+++ b/tests/scripts/dependencies/Repair-PackageManifestConsistency.RedirectSync.Tests.ps1
@@ -0,0 +1,218 @@
+Set-StrictMode -Version Latest
+
+BeforeAll {
+    $script:RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../../..')).Path
+    $script:EntryPoint = Join-Path $script:RepoRoot 'scripts/dependencies/Repair-PackageManifestConsistency.ps1'
+
+    # Every fixture is an in-memory string or hashtable and every filesystem dependency is
+    # injected, so no temporary file is created and nothing on disk is read except the entry
+    # point itself. No block or test name in this file matches the regex AC followed by a digit.
+    # The tree models issue 985: a production project references log4net 3.5.0.0, while a test
+    # project that neither declares nor references log4net keeps a transitive redirect to
+    # 3.4.0.0, which only a solution-wide pass can reach.
+
+    $script:ProdManifest = @'
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="log4net" version="3.5.0" targetFramework="net481" />
+</packages>
+'@
+
+    $script:ProdProject = @'
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0">
+  <ItemGroup>
+    <Reference Include="log4net, Version=3.5.0.0, Culture=neutral, PublicKeyToken=669e0ddf0bb1aa2a, processorArchitecture=MSIL">
+      <HintPath>..\packages\log4net.3.5.0\lib\net462\log4net.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+</Project>
+'@
+
+    $script:TestManifest = @'
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="Fabrikam.Core" version="1.0.0" targetFramework="net481" />
+</packages>
+'@
+
+    $script:TestProject = @'
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0">
+  <ItemGroup>
+    <Reference Include="Fabrikam.Core, Version=1.0.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\packages\Fabrikam.Core.1.0.0\lib\net472\Fabrikam.Core.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+</Project>
+'@
+
+    $script:TestAppConfig = @'
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <runtime>
+    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+      <dependentAssembly>
+        <assemblyIdentity name="log4net" publicKeyToken="669e0ddf0bb1aa2a" culture="neutral" />
+        <bindingRedirect oldVersion="0.0.0.0-3.4.0.0" newVersion="3.4.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="Fabrikam.Core" publicKeyToken="abcdef0123456789" culture="neutral" />
+        <bindingRedirect oldVersion="0.0.0.0-1.0.0.0" newVersion="1.0.0.0" />
+      </dependentAssembly>
+    </assemblyBinding>
+  </runtime>
+</configuration>
+'@
+
+    # Rendered with the line ending the repository's own files carry, as the sibling suite
+    # does, so the normalisation pass leaves the fixture byte-identical.
+    $script:ProdManifest = ($script:ProdManifest -replace "`r?`n", "`r`n") + "`r`n"
+    $script:TestManifest = ($script:TestManifest -replace "`r?`n", "`r`n") + "`r`n"
+    $script:ProdProject = $script:ProdProject -replace "`r?`n", "`r`n"
+    $script:TestProject = $script:TestProject -replace "`r?`n", "`r`n"
+    $script:TestAppConfig = $script:TestAppConfig -replace "`r?`n", "`r`n"
+
+    $script:AssemblyIdentity = @{
+        'log4net|3.5.0'       = @([pscustomobject]@{ AssetFolder = 'net462'; Version = '3.5.0.0' })
+        'Fabrikam.Core|1.0.0' = @([pscustomobject]@{ AssetFolder = 'net472'; Version = '1.0.0.0' })
+    }
+
+    $script:TestAppConfigPath = 'X:\fixture\Test\app.config'
+
+    function Get-RepairFixture {
+        <#
+        .SYNOPSIS
+            Builds an in-memory file store and the delegate set the entry point consumes.
+        #>
+        param(
+            [hashtable]$File,
+            [hashtable]$Asset = @{},
+            [hashtable]$Identity = @{},
+            [hashtable]$Listing = @{}
+        )
+
+        $store = @{}
+        foreach ($key in $File.Keys) { $store[$key] = $File[$key] }
+
+        # The three maps are read into locals so the closures below capture the locals.
+        # PSReviewUnusedParameter cannot see a parameter referenced only inside a nested
+        # scriptblock, so a body-level read is what keeps the analyzer clean here.
+        $assetMap = $Asset
+        $identityMap = $Identity
+        $listingMap = $Listing
+
+        return @{
+            Store    = $store
+            Argument = @{
+                RepositoryRoot           = $script:RepoRoot
+                DirectoryLister          = { @($store.Keys) }.GetNewClosure()
+                TextReader               = { param($Path) [string]$store[$Path] }.GetNewClosure()
+                TextWriter               = { param($Path, $Text) $store[$Path] = $Text }.GetNewClosure()
+                AssetFolderProvider      = { param($Id, $Version) @($assetMap[($Id + '|' + $Version)]) }.GetNewClosure()
+                AssemblyIdentityProvider = { param($Id, $Version) @($identityMap[($Id + '|' + $Version)]) }.GetNewClosure()
+                AnalyzerListingProvider  = { param($Id, $Version) @($listingMap[($Id + '|' + $Version)]) }.GetNewClosure()
+            }
+        }
+    }
+
+    function Get-TransitiveFixture {
+        <#
+        .SYNOPSIS
+            Builds the two-project store: a production project referencing log4net 3.5.0.0 and a
+            test project whose application configuration redirects log4net to 3.4.0.0.
+        #>
+        return Get-RepairFixture -File @{
+            'X:\fixture\Prod\packages.config' = $script:ProdManifest
+            'X:\fixture\Prod\Prod.csproj'     = $script:ProdProject
+            'X:\fixture\Test\packages.config' = $script:TestManifest
+            'X:\fixture\Test\Test.csproj'     = $script:TestProject
+            $script:TestAppConfigPath         = $script:TestAppConfig
+        } -Identity $script:AssemblyIdentity
+    }
+}
+
+Describe 'Repair-PackageManifestConsistency redirect synchronisation (issue 985)' {
+
+    Context 'A transitive redirect left stale by an upgrade elsewhere, with no candidate upgrade supplied' {
+        BeforeAll {
+            $script:Transitive = Get-TransitiveFixture
+            $argument = $script:Transitive.Argument
+            $script:FirstResult = & $script:EntryPoint @argument
+            $script:SecondResult = & $script:EntryPoint @argument
+            $script:SyncedConfig = $script:Transitive.Store[$script:TestAppConfigPath]
+        }
+
+        It 'rewrites the transitive redirect in both positions' {
+            $script:SyncedConfig | Should -Match 'oldVersion="0\.0\.0\.0-3\.5\.0\.0"'
+            $script:SyncedConfig | Should -Match 'newVersion="3\.5\.0\.0"'
+            $script:SyncedConfig | Should -Match 'newVersion="1\.0\.0\.0"' -Because 'the Fabrikam redirect already names a deployed version'
+        }
+
+        It 'reports the rewritten application configuration in the written paths' {
+            @($script:FirstResult.WrittenPath) | Should -Contain $script:TestAppConfigPath
+        }
+
+        It 'carries the synchronised-redirect block in the body' {
+            $script:FirstResult.Body | Should -Match '## Binding redirects synchronised'
+            $script:FirstResult.Body | Should -Match 'log4net 3\.4\.0\.0 to 3\.5\.0\.0'
+        }
+
+        It 'exposes the synchronisation in the RedirectSync field and not in the per-project repair records' {
+            $repair = @($script:FirstResult.RedirectSync.Repair)
+            $repair.Count | Should -Be 1
+            $repair[0].AssemblyName | Should -Be 'log4net'
+            $repair[0].From | Should -Be '3.4.0.0'
+            $repair[0].To | Should -Be '3.5.0.0'
+            $repair[0].Rule | Should -Be 'HighestDeployed'
+            $kind = @($script:FirstResult.Verification | ForEach-Object { @($_.Report.Repair) } |
+                    Where-Object { $null -ne $_ } | ForEach-Object { $_.Kind })
+            $kind | Should -Not -Contain 'BindingRedirectSync'
+        }
+
+        It 'states the direction of the synchronised redirect in the body' {
+            $script:FirstResult.Body | Should -Match 'log4net 3\.4\.0\.0 to 3\.5\.0\.0 \(HighestDeployed, Upgrade\)'
+        }
+
+        It 'writes nothing on a second run over the repaired store' {
+            @($script:SecondResult.WrittenPath).Count | Should -Be 0
+        }
+    }
+
+    Context 'The same tree run with -WhatIf' {
+        It 'leaves the stale redirect unchanged and writes nothing' {
+            $fixture = Get-TransitiveFixture
+            $argument = $fixture.Argument
+            $result = & $script:EntryPoint @argument -WhatIf
+            $fixture.Store[$script:TestAppConfigPath] | Should -Match 'newVersion="3\.4\.0\.0"'
+            @($result.WrittenPath).Count | Should -Be 0
+        }
+    }
+
+    Context 'An application configuration rewritten by both the redirect sync and the normalisation pass' {
+        BeforeAll {
+            # The sync pass writes the stale redirect and the normalisation pass then writes the
+            # collapsed assemblyBinding start tag, so one file is written twice in a single run.
+            $reflowed = $script:TestAppConfig.Replace('    <assemblyBinding xmlns=', "    <assemblyBinding`r`n        xmlns=")
+            $script:DoubleWrite = Get-RepairFixture -File @{
+                'X:\fixture\Prod\packages.config' = $script:ProdManifest
+                'X:\fixture\Prod\Prod.csproj'     = $script:ProdProject
+                'X:\fixture\Test\packages.config' = $script:TestManifest
+                'X:\fixture\Test\Test.csproj'     = $script:TestProject
+                $script:TestAppConfigPath         = $reflowed
+            } -Identity $script:AssemblyIdentity
+            $argument = $script:DoubleWrite.Argument
+            $script:DoubleWriteResult = & $script:EntryPoint @argument
+        }
+
+        It 'applies both rewrites to the application configuration' {
+            $stored = $script:DoubleWrite.Store[$script:TestAppConfigPath]
+            $stored | Should -Match 'newVersion="3\.5\.0\.0"'
+            $stored | Should -Match '<assemblyBinding xmlns="urn:schemas-microsoft-com:asm\.v1">'
+        }
+
+        It 'lists the application configuration once in the written paths' {
+            @($script:DoubleWriteResult.WrittenPath | Where-Object { $_ -eq $script:TestAppConfigPath }).Count | Should -Be 1
+        }
+    }
+}
diff --git a/tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1 b/tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
index 4fbea957f..d5b96cc3b 100644
--- a/tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
+++ b/tests/scripts/dependencies/RepositoryTreeConsistency.Tests.ps1
@@ -89,6 +89,32 @@ Describe 'Repository tree consistency (issue 929)' {
         $finding.Count | Should -Be 0 -Because ('these Import elements name a package the sibling manifest omits: ' + ($finding -join '; '))
     }
 
+    It 'reports no HintPath whose package folder the sibling manifest does not declare, for every project directory that carries a manifest' {
+        # Arrange: the pair discovery of the Import gate above, so both gates read one population.
+        $pair = @(Get-ChildItem -LiteralPath $script:RepoRoot -Directory | ForEach-Object {
+                $manifest = Join-Path $_.FullName 'packages.config'
+                $project = @(Get-ChildItem -LiteralPath $_.FullName -File | Where-Object { $_.Extension -eq '.csproj' })
+                if ((Test-Path -LiteralPath $manifest) -and $project.Count -eq 1) {
+                    [pscustomobject]@{ Project = $project[0].FullName; Manifest = $manifest }
+                }
+            })
+
+        # Act
+        $examined = 0
+        $finding = [System.Collections.Generic.List[string]]::new()
+        foreach ($entry in $pair) {
+            $detection = Find-OrphanedHintPath -ProjectText ([System.IO.File]::ReadAllText($entry.Project)) -ManifestText ([System.IO.File]::ReadAllText($entry.Manifest))
+            $examined += $detection.ExaminedCount
+            foreach ($item in @($detection.Finding)) {
+                $finding.Add(('{0}: line {1} {2}' -f (Split-Path -Leaf $entry.Project), $item.LineNumber, $item.PackageFolder))
+            }
+        }
+
+        # Assert: the examined count guards the zero finding count.
+        $examined | Should -BeGreaterThan 0 -Because 'a zero examined count would mean the detector never fired'
+        $finding.Count | Should -Be 0 -Because ('these HintPath elements name a package folder the sibling manifest does not declare: ' + ($finding -join '; '))
+    }
+
     It 'names in the SVGControl binding redirects the assembly version the SVGControl project reference declares' {
         # Arrange
         $projectText = [System.IO.File]::ReadAllText((Join-Path $script:RepoRoot 'SVGControl/SVGControl.csproj'))