fix(ribbon): report a repeated engine prime failure once per engine and failure kind

.claude/agent-memory/prd-feature/feedback_ac_gates_verify_satisfiability.md

@@ -18,4 +18,5 @@ Two rules for authoring/correcting acceptance criteria in spec.md:
 **How to apply:** During AC authoring, Glob for `<FEATURE>/evidence/baseline/*coverage*` and read the figures; when absent, phrase repo-wide clauses as testable-denominator per § UT2. When editing a spec mid-execution, always Read the current file first. Related: [[test-disposition-overload-pins]].
 6. Keep lambda arrows and percent signs out of asserted AC literals. Callers repeatedly forbid `<`, `>`, `${`, `$(` and `%` in anything that becomes an asserted literal, and a C# verification quoted verbatim (`parentCleanup.Verify(x => x.Invoke(), Times.Once)`) smuggles a `>` in through the lambda arrow. Describe the assertion instead — "an unaltered `Times.Once` verification of the parent-cleanup mock, positioned before the second `Cleanup()` call" — and write coverage floors as "90 percent", not "90%". Quoting the lambda verbatim in the non-AC Repro or Test Strategy prose is fine.
 7. The numeric-derivation validator matches a **standalone integer token** (`\b\d+\b`) on any `- [ ]` line inside `## Acceptance Criteria`, and once it fires it demands an eleven-label `## Numeric Derivation Evidence` record whose member sets are comma-separated enumerations with cardinality equal to their declared counts. For a population of a thousand-plus files that is unsatisfiable, so the only workable authoring move is to put **zero digits** in the AC section and write every count as a word — "zero", "exactly one", "all four spellings", "six required cases". Labels `AC1`..`AC14` are safe because the digit is preceded by a letter, so there is no word boundary. Every figure, table and file count goes in the body sections, where it is unconstrained. Seen on #602 (2026-09-12). Corollary learned on the same item: a sweep's terminal value is often **not** zero — one file was excluded from scope upstream — so state the non-zero terminal value in words and identify the surviving file in plain prose (no code span, so the blast-radius harvester does not read it as a write target).
+9. When the caller forbids digits on AC lines AND the evidence paths must be feature-relative in full (671 rule), the two collide: every feature folder name carries a date and an issue number. Resolution used on #948 (2026-10-01): name every evidence projection with its full backticked feature-relative path in Test Strategy only, give each a fixed digit-free filename, and have the AC line refer to it as "the Markdown fail-before projection named in Test Strategy under the feature's regression-testing evidence folder". Same move for test names: pick digit-free names (the research doc's names already were). Label criteria AC-A, AC-B, ... rather than AC1, AC2 when the prohibition is "any digit character" rather than the validator's word-boundary rule.
 8. An “every file in the Write Set obeys the 500-line ceiling” gate is a dead gate as written. The Write Set routinely contains non-SDK-style .csproj files that are thousands of lines long and Markdown documents, and `.claude/rules/general-code-change.md` scopes the 500-line limit to production code, test code, and reusable scripts while explicitly exempting Markdown. On #838 (2026-09-12) the caller's AC text said “and so does every file in the Write Set”; I narrowed it to the named .cs files only and stated the project-file/Markdown exemption inside the criterion. Enumerate the .cs files rather than saying “every file in the Write Set”.

.claude/agent-memory/task-researcher/MEMORY.md

@@ -20,6 +20,7 @@
 - [analyzer-severity-runsettings](project_analyzer_severity_ceiling_and_runsettings_split.md) — MSTEST0032 only rule above suggestion
 - [lock-recursion-317](project_lock_recursion_coverage_317.md) — deleted LockRecursionTests.cs is a restoration
 - [gettableinviewasync-838](project_gettableinviewasync_null_contract_838.md) — `maxAttempts:1` = TWO attempts; OCE is not TCE
+- [engine-toggle-fault-suppression-948](project_engine_toggle_fault_suppression_948.md) — pressed cache never clears; first fault can be NRE
 
 ## Coverage / Cobertura mechanics
 - [cobertura-closure-exemption-457](project_cobertura_closure_exemption_457.md) — exempt members emit NO `<method>`; async `d__` trap

.claude/agent-memory/task-researcher/project_engine_toggle_fault_suppression_948.md

@@ -0,0 +1,48 @@
+---
+name: engine-toggle-fault-suppression-948
+description: "#948 research (2026-10-01): EngineTogglePressedStateCache is never cleared so 'per episode' == 'per key per lifetime'; first prime fault can be a transient NRE (Engines assigned before AF.Manager); ResetConfigAsyncLazy has no post-ctor production caller; MSTest scripts have no filter parameter"
+metadata:
+  type: project
+---
+
+Research for issue #948 (permanent configuration fault logged on every cache-miss `getPressed` poll)
+completed 2026-10-01. Research file:
+`docs/features/active/2026-09-30-engine-toggle-permanent-config-fault-logs-every-poll-948/research/2026-10-01T07-20-engine-toggle-permanent-config-fault-logs-every-poll-research.md`
+
+**Why:** several facts about the ribbon toggle coordinator and its test tooling are non-obvious and
+will recur for #947 (throwing logError sink) and any later coordinator change.
+
+**How to apply:** when touching `EngineToggleStateCoordinator`, its four-plus test partials, or
+designing suppression/back-off policies anywhere a cache is populated once and never cleared.
+
+- **`EngineTogglePressedStateCache` has no remove/clear** (`NextSequence`, `TryGetActive`,
+  `TryApplyState` only; `_pressedState` is `readonly`). Once a key is cached, `StartPrimeIfNeeded`
+  is never reached again for it. Therefore "suppress until a success resets it" is UNOBSERVABLE
+  and untestable; a per-key suppression collapses to per-key-per-lifetime. Do not propose a
+  reset-on-success line; it cannot be pinned by a test.
+- **A transient first fault is structurally possible:** `ApplicationGlobals.cs:120` assigns
+  `Engines` in the ctor, `AppAutoFileObjects.Manager` is assigned only in the load paths
+  (`:68`, `:86`), so `EngineActiveAsync` can NRE before the permanent config fault appears. That is
+  why #948 recommends keying suppression on `(engineKey, failure.GetType())` rather than key alone.
+- **`AsyncLazy<T>` caches the faulted `Task` object** (`Lazy<Task<T>>` over `Task.Run(factory)`);
+  `ResetConfigAsyncLazy()` has exactly two production call sites, both inside `ManagerAsyncLazy`
+  (ctor `:41`, null-guard `:329`) — no production recovery path exists for a faulted config load,
+  and `IAppItemEngines` exposes nothing that reaches it. "Recovery via explicit reset" policies
+  have no caller.
+- **`Invoke-MSTestWithCoverage.ps1` / `Invoke-MSTest.ps1` have NO test-filter parameter**; the
+  inner vstest args are fixed (`/Settings`, `/InIsolation`, `/TestCaseFilter:TestCategory!=LiveOutlook`,
+  explicit `/ResultsDirectory` + `/Logger:trx;LogFileName=`). `-SearchRoot TaskMaster.Test` gives a
+  scoped run that skips the 80/75 thresholds. Per-class runs must invoke `vstest.console.exe`
+  directly with `/TestCaseFilter:FullyQualifiedName~...` (exact command shape in
+  `.../944/evidence/baseline/coordinator-tests-baseline.md:4`). No shell-icon exclusion exists in
+  repo scripts; the known shell-icon hang is UtilitiesCS.Test only.
+- **Fixture facts (2026-10-01):** four partials, 26 methods / 28 cases; main fixture 470 lines
+  (do not grow it); all prime-failure message assertions are `Contain(SpamEngine)`, so the
+  message text can change safely. `.Race.cs:195-202` remark says a re-prime "logs a second error"
+  — false once suppression lands.
+- **Session note:** the Bash tool can be disabled for a researcher session; verify commit claims
+  from file content (e.g. the `issue #944` comment in the production file) instead of `git log`.
+- The #947 promoted record was NOT present in the #948 worktree; describe #947 from the #944
+  spec (`:278`, `:287`) and research (§8 item 1).
+
+Related: [[ribbon-engine-toggle-defects-735]], [[ribbon-toggle-state-guards-505]], [[net481-timeprovider-available]]