fix(1005): isolate tests from shared user.config and wall clock

.claude/agent-memory/atomic-executor/MEMORY.md

@@ -34,6 +34,7 @@
 - [gh/CI-log traps](project_gh_ci_log_and_download_gotchas.md) (createdAt trips pr-author hook; ANSI in Pester log; gh download never overwrites) · [Abbreviated caller facts](project_caller_supplied_fact_list_can_be_abbreviated_and_look_like_a_plan_defect.md)
 
 - [MSTest summary absent on failure](project_mstest_runner_summary_absent_on_failure_voids_flaky_carveout.md) (flaky carve-out keyed on summary never fires; read the trx)
+- [Per-file token-count gate forbids helpers; scan artifact self-match](project_per_file_token_count_gate_forbids_helper_and_scan_artifact_self_match.md) (keep statements inlined; never quote the forbidden pattern)
 - [Generic seam over embedded interop = CS1769](project_generic_seam_over_embedded_interop_type_cs1769.md) (Func<Attachment,...> seams compile in UtilitiesCS, fail at every test call site)
 ## Sub-indexes (open when the topic is in scope)
 - [Test isolation + C# coverage](index_test_isolation_and_coverage.md) — vstest/MSTest hangs, flakiness, Cobertura/dotnet-coverage/Koverage

.claude/agent-memory/atomic-executor/project_per_file_token_count_gate_forbids_helper_and_scan_artifact_self_match.md

@@ -0,0 +1,16 @@
+---
+name: per-file-token-count-gate-forbids-helper-and-scan-artifact-self-match
+description: Exact per-file token-count gates (e.g. "_settingsStore.Save() = 9 in file X") forbid extracting the repeated statement into a helper; an evidence artifact that quotes its own forbidden-token search pattern makes the scan self-match
+metadata:
+  type: project
+---
+
+Two gate-shape traps seen while executing issue #1005 (settings-store seam).
+
+1. A plan's after-search asserted an exact per-file count of a statement token (Q2: `_settingsStore.Save()` 9 in AppStagingFilenames.cs, matching "each saving setter followed by `_settingsStore.Save()`"). Extracting the write+save into a private `Persist` helper is cleaner, but it collapses the count to 1 and fails the gate. Before refactoring repeated statements, grep the plan for count assertions on that token and keep the inlined form. The same applies to literal argument forms: a gate that asserts `timeProvider: new FakeTimeProvider()` fails if the value is first assigned to a local.
+
+2. A "no host path in evidence" scan (drive letter, Users segment, account name, AppData) matched its own artifact, because the artifact's Command field quoted the regex, which contains the account name. Describe the pattern in words in the artifact and re-run the scan after writing it.
+
+**Why:** both defects pass every build and test and surface only when the textual gate runs, so they cost a rewrite late in the plan.
+
+**How to apply:** before writing implementation, read the plan's search-definition section for per-file counts and literal forms. Write scan artifacts without quoting the forbidden tokens, then re-run the scan over the evidence tree once the artifact exists. Related: [[project_banned_api_zero_hit_gate_hits_doc_comments]].

.claude/agent-memory/atomic-planner/MEMORY.md

@@ -2,6 +2,8 @@
 
 ## Preflight revision seams (per issue; newest first)
 
+- [#1005 R1](project_1005_r1_jacoco_projection_is_package_level_only.md) — JaCoCo projection is package-level only; per-file coverage ACs read Cobertura
+- [#1005 R0](project_1005_r0_settings_store_seam_and_probe_seams.md) — SettingsSaving probe locks add/remove; "<=500 and smaller" AC contradiction amended; IDList null-ctor ambiguity
 - [#985 R1](project_985_r1_scratchpad_identity_and_double_write_seams.md) — never spell the scratchpad (encoded name holds the account); sweep diff + untracked; reflowed tag forces a double write
 - [#985 R0](project_985_r0_rehearsal_fidelity_and_hygiene_path_seams.md) — merge-into-Dependabot rehearsal needs a simulated nuget update; hygiene guard flags Users paths in tracked plans; Invoke-VSBuild rewrites csproj
 - [#973 R1](project_973_r1_last_task_artifact_only_commit_and_measured_line_length_seams.md) — last task commits its artifact alone; dossier cites no later result; measure line length with `^.{N,}`; Glob zero-gate needs a positive control

.claude/agent-memory/atomic-planner/project_1005_r0_settings_store_seam_and_probe_seams.md

@@ -0,0 +1,18 @@
+---
+name: project-1005-r0-settings-store-seam-and-probe-seams
+description: #1005 R0 planning seams - SettingsSaving probe needs lock around add/remove, "<=500 and smaller" AC contradiction for already-oversized files, IDList null-ctor overload ambiguity, coverage script already applies parallel runsettings
+metadata:
+  type: project
+---
+
+Planned #1005 (parallel test failures: DfDeedle wall clock + shared user.config) on 2026-10-22.
+
+- `ApplicationSettingsBase.SettingsSaving` has explicit add/remove over a plain delegate field (not atomic); concurrent probe tests on one `Settings.Default` must `lock (settings)` around `+=`/`-=` only, which does not serialize tests.
+- An AC saying "every Write Set file <= 500 lines AND file X (already 848) is smaller" is unsatisfiable for X; the planner amended spec AC7 to an explicit exception rather than leaving the executor to interpret it.
+- `new IDList(null)` is ambiguous once an `IDList(ISettingsStore)` overload exists; null-guard tests must cast `(ISettingsStore)null` or use the two-arg overload.
+- `scripts/vscode/Invoke-MSTestWithCoverage.ps1` already applies `TaskMaster.cli.runsettings` (Workers 0, ClassLevel), writes `coverage.cobertura.jacoco.xml` and `mstest-coverage-run.summary.txt`, and retains the post-processed Cobertura only in `coverage/`; copy it to SCRATCH for a later baseline comparison.
+- `docs/features/templates/policy_audit/` does not exist in TaskMaster; self-review tasks record the template as a deviation (same as #1002).
+- A test helper not in the spec Write Set was added by amending the spec Write Set in the same planning pass, so the scope fence has one source.
+
+**Why:** these were the non-obvious points found while re-deriving citations; each would otherwise surface as a preflight or review defect.
+**How to apply:** reuse for any later settings-persistence or parallel-isolation plan in TaskMaster. Related: [[reference-invoke-mstest-with-coverage-script]], [[acceptance-criteria-are-amended-by-planners-not-executors]].

.claude/agent-memory/atomic-planner/project_1005_r1_jacoco_projection_is_package_level_only.md

@@ -0,0 +1,12 @@
+---
+name: project-1005-r1-jacoco-projection-is-package-level-only
+description: TaskMaster's committed JaCoCo projection holds package LINE/BRANCH counters only; per-file or per-member coverage ACs must read the Cobertura document
+metadata:
+  type: project
+---
+
+`ConvertTo-JacocoPackageProjection` (scripts/vscode/Invoke-MSTestWithCoverage.Projection.ps1) emits package-level LINE and BRANCH counters only, no class/method/sourcefile/line data. An AC that says a file or member reaches N% "read from the committed coverage projection" is unsatisfiable (#1005 preflight R1 substantive defect).
+
+**Why:** CLAUDE.md permits committing only the projection, so authors reach for it as the source; it cannot carry per-file figures.
+
+**How to apply:** word per-file/per-member coverage ACs as "read from the post-processed Cobertura document and recorded in the committed coverage-comparison evidence"; amend the spec before P0 copies it. Also: never leave a `PREFLIGHT:` line in the plan body. See [[project-1005-r0-settings-store-seam-and-probe-seams]].

.claude/agent-memory/feature-review/MEMORY.md

@@ -111,6 +111,7 @@
 
 ## Closed-issue residuals (lookup only; details in the residuals index)
 - [review-residuals index](project_review-residuals-index.md) — per-issue summaries #442-#968 (#930 host-path PARTIAL; #942 `.csproj` disarms C# hook check)
+- [1005](project_1005-review-residuals.md) — helper deletion stripped an unchanged member's only caller; covered-count arithmetic exposes it; cycle 2 PASS; `git log %cr` gives "now"
 - [1002](project_1002-review-residuals.md) — aria-selected with no CSS = blocking; ratified exemption left AC23 false (cycle 1); cycle 2 PASS; span wrap needs closest() click routing
 - [985](project_985-review-residuals.md) — cycle 1 blocker: account name in encoded scratchpad dir; cycle 2 PASS; hook sim param is `-RawPayload`
 - [973](project_973-review-residuals.md) — AC premise defect = autonomous spec amendment; bundled PoshQC FAIL row + vacuous PASS

.claude/agent-memory/feature-review/project_1005-review-residuals.md

@@ -0,0 +1,16 @@
+---
+name: 1005-review-residuals
+description: "#1005 cycle 1: 8/8 AC PASS but 1 blocking - deleting an AC-mandated test helper stripped the only caller of an unchanged member (IDList.MaxLengthOfID 7/7->0/7); found by covered-count arithmetic, not by the executor's changed-line comparison"
+metadata:
+  type: project
+---
+
+#1005 (settings-store seam + FakeTimeProvider for parallel tests), review 2026-10-22T17-10: REMEDIATION_REQUIRED, 1 blocking (B-1, autonomous), all 8 AC PASS and left checked.
+
+B-1: AC2 required deleting `CreateListWithCachedMaxLength` in `IDListGetNextToDoIDTests`; its `_ = list.MaxLengthOfID;` was the only test execution of the public getter. Baseline Cobertura 7/7 lines 4/4 branches -> head 0/7 lines 0/4 branches; `IDList.cs` branch 20.69 -> 19.35 while line rose. The executor's coverage comparison checked changed lines and replaced lines only, so it reported PASS.
+
+**Why:** a changed-line-only comparison is blind to coverage lost on UNCHANGED lines when a test refactor removes their only caller. The tell was arithmetic: added covered lines (13) vs covered-count delta (+6) left 7 unexplained.
+
+Cycle 2 (R4, 2026-10-22T17-23, head 3df0782ab): PASS, 0 blocking. Three store-injected MaxLengthOfID tests restored the getter to 7/7, 4/4; IDList.cs 51/169 = 30.18% / 25.81% (arithmetic matched exactly: 44 + 7). Under a git-diff/git-log-only Bash rule, read "now" from `git log -1 --format="%cI | %cr"` on the head commit (commit time + relative age).
+
+**How to apply:** for every modified production file, compute expected covered = baseline covered + added covered lines; if head is lower, diff `<method>` nodes between the baseline and head Cobertura (the executor's baseline Cobertura usually survives in the session scratchpad under `issue-<N>/`; Glob `AppData/Local/Temp/claude/**/issue-<N>-baseline-cobertura.xml`). Also check branch-rate, not just the line figure the executor quoted. Classify as blocking-autonomous when the modified file is sub-floor and regressed (see [[modified-file-subfloor-nonblocking-disposition-230]]); keep the ACs checked when the loss sits outside their literal text. Line-110-style "branch" on a cached static lambda needs >=2 executions in one run to cover both arms.

.claude/agent-memory/orchestrator/MEMORY.md

@@ -3,6 +3,7 @@
 ## Lifecycle, promotion, checkpoint
 - [Isolated child: wait via git pickaxe; name the item in Agent prompts](isolated-child-liveness-wait-and-delegation-target-lines.md) — no sleep route; `Canonical issue number` + `branch:` lines
 - [Evidence + lifecycle for every change](evidence-and-lifecycle-for-every-change.md) · [Small-path = minor-audit](small-path-minor-audit-selection.md) — 1-3 prod files = small path
+- [Small->large reroute flips work mode to full-bug](small-to-large-reroute-flips-work-mode.md) — edit the issue.md marker before prd-feature; restamp future-dated evidence
 - [potential_to_issue creates the issue](potential-to-issue-creates-github-issue.md) · [needs an absolute path](potential-to-issue-needs-absolute-path.md) · [maps sections by heading](potential-to-issue-keeps-only-summary-section.md)
 - [Promotion potential .md may not persist](promotion-potential-md-may-not-persist.md) · [new_active_feature_folder date prefix](new-active-feature-folder-date-prefix.md)
 - [Verify an issue is open in SUBSTANCE](verify-issue-still-open-in-substance.md) — the residual may already be its own issue

.claude/agent-memory/orchestrator/small-to-large-reroute-flips-work-mode.md

@@ -0,0 +1,24 @@
+---
+name: small-to-large-reroute-flips-work-mode
+description: When a seeded small/minor-audit item turns out to need 4+ production files, flip issue.md to full-bug before prd-feature; also restamp executor evidence whose filename time is in the future
+metadata:
+  type: project
+---
+
+On #1005 (2026-10-22) a seeded `small` + `minor-audit` checkpoint had to become `large` once AC4
+("fix every test that reaches Settings.Default.Save()") pulled in 7 production files. The large route
+runs prd-feature, and a spec.md in a minor-audit folder is an integrity failure, so I edited the
+issue.md marker to `- Work Mode: full-bug`, set checkpoint `work-mode`/`path_selected`/`route_id`, and
+recorded a `route_change` block. spec.md then became the AC source (issue AC1-AC7 carried forward plus
+AC8). The whole run (research, spec, plan, 2 preflights, execution, 1 remediation cycle, PR, CI) finished
+in about 2.5 hours and `require_complete` + `require_model_routing` passed with
+`required_mcp_tools` naming `new_potential_bug_entry`.
+
+**Why:** the user's seed said "switch to large if >3 files"; doing the work-mode flip up front avoided
+the prd-feature/minor-audit conflict. Give the researcher the 11-label `## Numeric Derivation
+Evidence` spec in its prompt (see [[prd-feature-stop-hooks-are-workmode-blind]]); even so it named two
+labels `Primary Search Strategy` instead of `... or Query Expression`, so prd-feature wrote count-free ACs.
+
+**How to apply:** after every executor return, compare evidence filename stamps with file
+LastWriteTimeUtc; a sonnet remediation executor stamped 11 files 10-20 minutes in the future. Rename to
+the write time and fix the `Timestamp:` line before committing. See [[evidence-timestamps-can-be-synthesized]].

.claude/agent-memory/prd-feature/feedback_ac_gates_verify_satisfiability.md

@@ -23,4 +23,5 @@ Two rules for authoring/correcting acceptance criteria in spec.md:
 8. An “every file in the Write Set obeys the 500-line ceiling” gate is a dead gate as written. The Write Set routinely contains non-SDK-style .csproj files that are thousands of lines long and Markdown documents, and `.claude/rules/general-code-change.md` scopes the 500-line limit to production code, test code, and reusable scripts while explicitly exempting Markdown. On #838 (2026-09-12) the caller's AC text said “and so does every file in the Write Set”; I narrowed it to the named .cs files only and stated the project-file/Markdown exemption inside the criterion. Enumerate the .cs files rather than saying “every file in the Write Set”.
 12. Refinement of item 7, from reading `.claude/hooks/validate-prd-feature-output.ps1` on #973 (2026-10-02): digits on AC lines are NOT banned outright. The hook fires on `\b\d+\b` in any checkbox line under `## Acceptance Criteria`, then validates ONLY the single `research-path:` file named in the final output, taking the FIRST match of each of the eleven labels inside the first `## Numeric Derivation Evidence` section (`###` sub-blocks stay inside that section because the lookahead is `^##\s`). So when the supplied research record was authored to pass (one-line label values; "entire/all/complete ... repository" in the scope; two differently worded strategies that each contain every Complete Family member verbatim; comma-separated member sets whose cardinality equals the counts; the word "equal/match/identical" in the comparison), trace those checks by hand once, then use the derived counts freely. Counts the record does NOT derive (on #973: fourteen files, thirteen ADAL blocks) still go in as an enumeration or an absence, with one sentence in the AC section saying why. A second research file's derivation blocks can back further counts in the body and in AC prose, but the hook never reads it; report it on a line whose label is not `research-path` (for example `supplemental-research-path:`) so the hook's `^\s*research-path\s*:` regex does not pick it up.
 13. Hyphenated identifiers leak standalone digits: `CR-1`, `L4-T1`, `#956`, `T12` differ. `\b\d+\b` matches the `1` in `CR-1` (hyphen is a non-word character) and the `956` in `#956`, but not `T12`, `L4`, `AC16` or `FileIO2` (letter adjacent). On #959 (2026-10-02) two AC lines failed my own post-write Grep on `CR-1` and on the predecessor feature-folder path. Always run `Grep '^- \[ \] AC.*(\b[0-9]+\b|[<>%])'` on the spec after writing and before reporting; rename hyphenated finding labels to words on AC lines ("the predecessor-spec wording correction") and point at in-scope files in other feature folders via "full backticked path in Proposed Fix Dn" so the footprint harvester still sees the path.
+15. Hook trigger narrowed (issue #905 rule R2, observed #1005 on 2026-10-22): `Test-SpecNumericCriterion` now fires only on a determiner-led cardinal count of a plural noun on a checkbox line (`all|exactly|the|these|those` + digit or number word up to twenty + plural noun), skipping lines citing `.claude/rules/`. Bare digits no longer fire it. Also check the research record's label names literally: on #1005 the researcher wrote `Primary Search Strategy:` instead of `Primary Search Strategy or Query Expression:`, which fails the hook's label regex, so the record cannot back any count; enumerate the population by name on AC lines and say so in Assumptions.
 14. Evidence paths cannot appear in AC lines at all in this repo: the feature-folder slug carries the date and the issue number, so a full feature-relative evidence path trips the zero-digit rule (item 7), and a bare `evidence/...` span trips the blast-radius harvester. Resolution used on #942 (2026-09-29): put the full backticked paths in Test Strategy, and in each AC refer to the projection by its unbackticked bare filename plus "under the feature folder's <kind> evidence directory (full path in Test Strategy)". Also avoid `` `try`/`finally` ``: the slash between two adjacent spans reads as a one-character path span to a naive regex; write "try-finally".

.claude/agent-memory/task-researcher/MEMORY.md

@@ -23,6 +23,7 @@
 - [svgcontrol-test-418](project_svgcontrol_test_unwired_418.md) — STALE (in .sln since 2026-08-14)
 
 ## Threading / test determinism
+- [settings-save-1005](project_settings_save_shared_user_config_1005.md) — 26 Settings Save() sites share one user.config; ISettingsStore seam; SettingsSaving cancel probe
 - [taskrun-getresult-inlines-900](project_taskrun_getresult_inlines_on_pool_thread_900.md) — Task.Run+GetResult on a pool thread INLINES
 - [taskrun-triage-931](project_taskrun_triage_931.md) — 2/22 Task.Run sites thread-dependent; OpenRead returns FileStream
 - [prime-marker-944](project_prime_marker_register_before_start_944.md) — ContinueWith(None) never inlines; TCS marker before start

.claude/agent-memory/task-researcher/project_settings_save_shared_user_config_1005.md

@@ -0,0 +1,12 @@
+---
+name: settings-save-shared-user-config-1005
+description: 26 production Settings Save() sites (15 test-reached) race on one testhost user.config; per-instance ISettingsStore seam + SettingsSaving cancel probe for fail-before
+metadata:
+  type: project
+---
+
+Issue #1005 (2026-10-22): every `Properties.Settings.Default.Save()` reached by a test races on the single host-derived user.config ("configuration file has been changed by another program"). Repo-wide there are 26 settings Save() sites (IDList 1, AppQuickFilerSettings 6, AppStagingFilenames 9, AppAutoFileObjects 6 via `_defaults.Save()`, AppOlObjects.JunkFolders 3, AppOlObjects DarkMode 1); 15 are test-reached. Test code also calls `defaults.Save()` in AppAutoFileObjectsCoverageExpansionTests.TestCleanup.
+
+**Why:** `new IDList()` has `_maxIDLength == 0`, so the first GetNextToDoID always saves; TaskTree.Test MakeController hands out a fresh real IDList.
+
+**How to apply:** recommend a public UtilitiesCS `ISettingsStore` (indexer + Save) with an `ApplicationSettingsBase` adapter, injected per instance. The adapter is coverable via a test subclass overriding the indexer and Save (both overridable). A deterministic fail-before: subscribe `SettingsSaving`, set `e.Cancel = true` (skips `base.Save`), attribute by thread id, unsubscribe in finally. Watch for grep misses: `_defaults.Save()` and `defaults.Save()` do not match `Settings.Default.Save()`. ToDoModel.Test and TaskTree.Test are C# 7.3 (no LangVersion).