fix(deps): declare borrowed test packages and sync transitive binding redirects (#985)

.claude/agent-memory/atomic-executor/project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md

@@ -0,0 +1,21 @@
+---
+name: mstest-runner-summary-absent-on-failure-voids-flaky-carveout
+description: Invoke-MSTestWithCoverageMain writes mstest-coverage-run.summary.txt only after a zero collector exit, so a flaky-test carve-out keyed on its "Failed tests:" line can never fire; key it on the raw trx instead
+metadata:
+  type: project
+---
+
+`scripts/vscode/Invoke-MSTestWithCoverage.ps1` throws `MSTest with coverage failed with exit code N`
+inside `Invoke-DotnetCoverageCollection` (line 262 as of 2026-10-09) before post-processing, the
+projection, and the summary file are produced. The `.summary.txt` holding
+`Failed tests: <names>` therefore exists only on a green run, and it always reads `Failed tests: none`.
+
+**Why:** plan #985 r0 C7 allowed one re-measurement when `RUNNER_RESULT=THREW` and the
+`TRX-SUMMARY: Failed tests:` line named only the known flaky test (#780). On a red run that line is
+never printed (the wrapper deletes the stale summary first), so the rule was unreachable and a
+single flaky failure would have become a hard STOP.
+
+**How to apply:** at preflight, a flaky carve-out over this runner must read failed names from
+the raw `coverage\test-results\mstest-coverage-run.trx` (still present after the throw), e.g.
+`//*[local-name()='UnitTestResult'][@outcome='Failed']` -> `testName`, printed as
+`TRX-FAILED-TEST:` lines (names only, no paths). Related: [[flaky-test-carveout-added-to-one-task-only]].

.claude/agent-memory/atomic-executor/project_poshqc_analyze_flags_new_verb_test_helpers_and_comma_return.md

@@ -0,0 +1,15 @@
+---
+name: project-poshqc-analyze-flags-new-verb-test-helpers-and-comma-return
+description: PoshQC analyze fails on New-* helper functions inside Pester BeforeAll (ShouldProcess rule) and on unary-comma returns whose OutputType says string[]; MCP gives only an issue count
+metadata:
+  type: project
+---
+
+The bundled PoshQC analyzer (mcp__drm-copilot__run_poshqc_analyze) returned `ok: false` with only "PSScriptAnalyzer reported 7 issue(s)" on issue #985. A plain `Invoke-ScriptAnalyzer -Path <file>` (default rules) over the Write Set reproduced exactly the same 7 findings, so it is a usable diagnosis route when the MCP tool gives no detail.
+
+The two finding classes:
+- PSUseShouldProcessForStateChangingFunctions (Warning) on test-file helper functions named `New-*` defined inside a Pester `BeforeAll` (fixture builders such as New-AppConfigText). Fix: name fixture builders with the `Get-` verb.
+- PSUseOutputTypeCorrectly (Information, still counted) on a private helper that returns `, [string[]]$value` with `[OutputType([string[]])]`: the analyzer infers Object[]. Fix: emit values unwrapped with `[OutputType([string])]` and have callers collect with `@(...)`.
+
+**Why:** each costs a full PowerShell loop restart (format, analyze, test, coverage) under the plan's C7 rule.
+**How to apply:** when writing new Pester helpers or module helpers, use Get- verbs and avoid unary-comma returns from the start; when the MCP analyze reports only a count, run Invoke-ScriptAnalyzer per file to list them. See also [[project-rehearsal-merge-x-ours-drops-adjacent-manifest-edits]].

.claude/agent-memory/atomic-executor/project_rehearsal_merge_x_ours_drops_adjacent_manifest_edits.md

@@ -0,0 +1,13 @@
+---
+name: project-rehearsal-merge-x-ours-drops-adjacent-manifest-edits
+description: In a Dependabot-branch rehearsal, git merge -X ours silently dropped fix insertions/deletions next to bumped manifest lines; nuget update CLI leaves test app.config redirects stale
+metadata:
+  type: project
+---
+
+Issue #985 rehearsal (2026-10-09): merging the fix branch into the PR #984 Dependabot branch with `git merge -X ours` exited 0 with an empty porcelain, yet dropped two of four packages.config insertions (those adjacent to `MSTest.TestFramework` lines Dependabot bumped) and the deletion of a duplicate csproj ItemGroup. Only a content check (Grep per declaration, blob equality per script) revealed it; the merge stat was the only visible hint (two manifests and the csproj missing from it).
+
+Also observed: `nuget update <packages.config> -Id X -Version Y` rewrites the manifest and the csproj HintPaths/References but does not touch the project's app.config binding redirect, and it writes the manifest in a non-canonical form that Invoke-ManifestNormalization then reflows.
+
+**Why:** a rehearsal that trusts the merge exit code would build a tree that is not the fix.
+**How to apply:** after any `-X ours`/`-X theirs` rehearsal merge, verify every fix element by content and re-apply drops; expect the repair run after a simulated nuget update to write app.config redirects (OwnReference) and the updated manifests (normalisation). Related: [[project-poshqc-analyze-flags-new-verb-test-helpers-and-comma-return]].

.claude/agent-memory/atomic-planner/project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md

@@ -0,0 +1,17 @@
+---
+name: project-985-r0-rehearsal-fidelity-and-hygiene-path-seams
+description: "#985 round 0 plan seams - a merge-the-fix-into-the-Dependabot-branch rehearsal is unfaithful when the fix adds package declarations (the test projects stay pinned to the old version; simulate Dependabot's bump with nuget update per new pair); the hygiene guard fails CI on any drive-rooted Users path in a tracked file, including the plan itself and caller-supplied scratchpad paths; Invoke-VSBuild runs Sync-PackageReferences which rewrites csproj HintPaths; rehearsal merges need -X ours plus content re-apply"
+metadata:
+  type: project
+---
+
+Planning #985 (2026-10-09; Dependabot repair: borrowed test packages + transitive binding redirects) surfaced four seams.
+
+**Why:** each would have produced a false rehearsal failure or a red hygiene CI job unrelated to the fix.
+
+**How to apply:**
+- A rehearsal that merges a fix adding `packages.config` declarations into an existing Dependabot branch leaves the newly declaring projects at the pre-bump version while their production references are bumped; the post-merge `@dependabot recreate` would bump them too. Insert a simulated Dependabot step (`nuget update <proj>\packages.config -Id -Version -RepositoryPath`) for each new pair whose production sibling differs, leave redirects to the repair script, and flag the decision to the caller (the AC text did not mention it).
+- `scripts/hygiene/Test-RepositoryHygiene.Rules.ps1` line 21 flags `[a-z]:[\\/]+users[\\/]+...` in every tracked file. A caller-supplied scratchpad path (C-drive Users temp dir) must be written as `$env:LOCALAPPDATA\Temp\...` in the plan, and every helper script must replace roots and profile paths before printing. Positive control for a zero-count scan: the linked worktree's `.git` pointer file matches once.
+- `scripts/vscode/Invoke-VSBuild.ps1` lines 247-253 run `Sync-PackageReferences.ps1` before building, which can rewrite csproj HintPaths; for manifest-defect work resolve MSBuild via vswhere and run the CLAUDE.md arguments directly.
+- Long helper payloads go into scratch `.ps1` files outside the repo (the PS batch-budget hook ignores paths outside the root, line 288), which also removes Bash-to-pwsh quoting hazards.
+- Related: [[project-930-uithread-ilglobals-comments-plan-seams]] (runner dot-source + redefine for the shell-icon filter), [[poshqc-mcp-and-msbuild-invocation-facts]].

.claude/agent-memory/atomic-planner/project_985_r1_scratchpad_identity_and_double_write_seams.md

@@ -0,0 +1,17 @@
+---
+name: project-985-r1-scratchpad-identity-and-double-write-seams
+description: "#985 R1 remediation seams - the session scratchpad's encoded directory name carries the account name, so a plan must never spell it (define SCRATCH as 'the scratchpad named in the executor's environment'); a pre-commit identity sweep must read diff-added lines AND untracked files with run-time-derived tokens plus synthetic and .git-pointer controls; a reflowed assemblyBinding start tag makes the sync and normalisation passes write one app.config twice"
+metadata:
+  type: project
+---
+
+Remediation cycle 1 of #985 (2026-10-09) was driven by review B-1: the round-0 plan wrote the encoded session-scratchpad folder through `$env:LOCALAPPDATA`, which removed the drive-rooted path but kept the account name inside the encoded segment (`C--Users-<user>-...`).
+
+**Why:** the caller-supplied scratchpad path always embeds the account name in its encoded worktree segment, so any plan that copies it leaks the identifier even when it avoids a drive-rooted path; the CI hygiene pattern does not catch it (no colon).
+
+**How to apply:**
+- Define `SCRATCH` as "the session scratchpad named in the executing agent's own environment block"; never spell it, not even via an environment variable. Have Phase 0 rewrite helper scripts into it from the prior plan's cited line spans.
+- An identity sweep that runs before the commit must read `git diff <base>` added lines (merge base vs working tree) plus every `git ls-files --others --exclude-standard` file; after the commit run the same script over `<base>...HEAD` and report it in the return message (no file, so the tree stays clean). Tokens: leaf of `$env:USERPROFILE`, 8.3 short form from `$env:TEMP`, `$env:COMPUTERNAME`, `git config user.email`; controls: synthetic `x<token>y` per token and the worktree `.git` pointer file.
+- To reproduce a duplicate `WrittenPath` in `Repair-PackageManifestConsistency.ps1`, split the `<assemblyBinding` start tag across two lines in a stale app.config fixture: the sync pass writes the redirect, then `ConvertTo-AppConfigText` collapses the tag and writes again. Guard with a sibling `It` proving both rewrites landed.
+- `Invoke-BindingRedirectReconciliation` already matches names case-insensitively, so a case-variant duplicate block only produced a redundant repair record; the regression test asserts the repair count, not the text.
+- Related: [[project-985-r0-rehearsal-fidelity-and-hygiene-path-seams]], [[runtime-derived-account-token-pattern]].