diff --git a/.claude/agent-memory/atomic-executor/MEMORY.md b/.claude/agent-memory/atomic-executor/MEMORY.md
index a69672a0c..989165573 100644
--- a/.claude/agent-memory/atomic-executor/MEMORY.md
+++ b/.claude/agent-memory/atomic-executor/MEMORY.md
@@ -2,6 +2,7 @@
 
 ## Plan validation & gates
 - [Self-derived gate thresholds are blind](project_preflight_selfderived_gate_thresholds_are_blind.md) — a "count >= floor" gate whose floor comes from the runs it validates is deflation-blind + scope-incommensurable; use git-enumeration + `/ListTests` existence proofs
+- [Merge-base diff gates need a commit cadence](project_preflight_mergebase_diff_gates_need_commit_cadence.md) — `<MERGE_BASE>..HEAD` gates are vacuous while HEAD == merge-base and unsatisfiable once HEAD is ahead; on a later cycle scope-audit via `git show --numstat --format= HEAD`
 - [Inserted plan tasks force renumbering](project_plan_task_ids_digit_only_forces_renumbering.md) — suffixed IDs (`P3-T5a`) fail validation; say "insert + renumber downstream", then verify defs-vs-mentions mechanically
 - [Plan rationale clauses are evidence](project_418_plan_rationale_clauses_are_evidence.md) — #418 needed 3 preflight passes; all blockers were unmeasured world-state claims in prose, never in the fix
 - [#418 500-line gate vs mandated plan content](project_418_500line_gate_vs_plan_content.md) — P1-T19 unsatisfiable (193 new lines into 146 headroom); per-block logging clauses block centralizing; delta = extract helpers to a new file
@@ -22,11 +23,16 @@
 - [Legacy csproj: no transitive compile refs](project_legacy_csproj_no_transitive_compile_refs.md) — non-SDK ProjectReference doesn't flow package types to csc (CS0012 despite copy-local DLL); tests need their own `<Reference>` + packages.config entry
 - [sln/csproj edits: preserve CRLF](project_sln_csproj_edit_crlf_preserve.md) — git-bash `sed -i` strips CRLF from TaskMaster.sln (churn + BOM loss); use Edit or `perl -0777` w/ explicit `\r\n`
 - [Incremental build makes a vacuous baseline](project_incremental_build_vacuous_baseline.md) — Invoke-VSBuild's /t:Build up-to-date check ignores /p: changes → EXIT 0 with 0 CoreCompile; add /t:Rebuild to enumerate diagnostics
+- [Nullable /t:Build gate is vacuous](project_nullable_build_gate_is_vacuous_incremental.md) — the standard nullable gate passes without type-checking; isolated `/t:Rebuild ... /p:BuildProjectReferences=false` exposed 223 errors (never add /p:OutputPath — it breaks ProjectReference resolution)
+- [CSharpier 1.3.0 formats XML at 100 cols](project_csharpier_formats_xml_print_width.md) — a "reformatting churn" finding on an XML resource can be formatter-mandated; measure line length + run repo-wide `check` before accepting it
+- [Evidence <TS> collision clobbers committed artifacts](project_evidence_timestamp_collision_clobbers_artifacts.md) — same-day remediation can silently overwrite implementation-cycle evidence; a ` M` under `evidence/` means clobber
 - [csharpier pipe-files is a non-enforcing gate](project_csharpier_pipefiles_nonenforcing_gate.md) — use `csharpier check`/`format`; tests balloon past 500 lines under genuine format (size new files AFTER format)
 - [PowerShell new files need UTF-8 BOM](powershell-bom-required.md) — PSScriptAnalyzer enforces PSUseBOMForUnicodeEncodedFile; prepend BOM after Write or restart the format loop
 - [poshqc Pester MCP exits -1](project_poshqc_pester_mcp_exit_minus1.md) — run_poshqc_test exits -1 (no detail) here; run it for the record, pair with direct Invoke-Pester (pwsh7) for the numeric proof
 - [BOM breaks grep ^ anchor](project_bom_grep_anchor_false_negative.md) — bash grep `^#nullable` misses BOM-prefixed files; use the Grep tool for opt-in classification, never bash grep
 
+- [Compile-time red needs body-level refs](project_compile_red_needs_body_level_references.md) — a missing type in a method SIGNATURE suppresses body binding, so an `[expect-fail]` task requiring N named CS0246s reports only 1; construct the types inline in test bodies
+
 ## Test execution & isolation
 - [vstest /InIsolation + FilePathHelper serialization](project_vstest_isolation_and_filepathhelper_serialization.md) — Moq assemblies need /InIsolation (else STTE Setup FileNotFound); FilePathHelper.FilePath is "" default but null after JSON deserialize
 - [Invoke-MSTest.ps1 dies on a single test assembly](project_418_invoke_mstest_single_assembly_bug.md) — StrictMode + `.Count` on a scalar String throws before vstest runs; call vstest.console.exe directly with the script's arg list
diff --git a/.claude/agent-memory/atomic-executor/project_compile_red_needs_body_level_references.md b/.claude/agent-memory/atomic-executor/project_compile_red_needs_body_level_references.md
new file mode 100644
index 000000000..08a93b9ab
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_compile_red_needs_body_level_references.md
@@ -0,0 +1,14 @@
+---
+name: compile-red-needs-body-level-references
+description: A compile-time [expect-fail] task that must name N missing types will only report the ones bound in the same phase; a missing type in a method SIGNATURE suppresses all body-level diagnostics
+metadata:
+  type: project
+---
+
+When an `[expect-fail]` task's acceptance criterion requires the fail-before diagnostics to name several not-yet-existing types, put every reference in a **method body**, never in a signature.
+
+Roslyn binds declarations first. If a private helper is declared `private static EngineReadinessGate CreateGateOver(...)` and `EngineReadinessGate` does not exist, the compiler emits one `CS0246` for that signature and then **does not bind any method body**, so a second missing type referenced only inside bodies never surfaces. Measured on #503 (2026-08-08): first run produced 1 diagnostic naming only `EngineReadinessGate`; after changing the helper's return type to a resolvable `Func<IAppItemEngines>` and constructing both types inline in the test bodies, the same command produced 4 diagnostics naming both `EngineReadinessGate` and `EngineGatedCommandRunner`.
+
+**Why:** the plan's binary outcome was "diagnostics must include CS0246 naming X and Y". Recording a partial diagnostic set as satisfying it would be a false PASS, and re-running the build does not help — the shape of the test file is what determines which errors are reachable.
+
+**How to apply:** before running the `[expect-fail]` build, check that no not-yet-existing type appears in any `class`/method/field declaration in the new test file. Keep helper signatures built only from types that already compile. Record the restructure in the fail-before artifact so the edit between the two runs is auditable.
diff --git a/.claude/agent-memory/atomic-executor/project_csharpier_formats_xml_print_width.md b/.claude/agent-memory/atomic-executor/project_csharpier_formats_xml_print_width.md
new file mode 100644
index 000000000..1a21734e7
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_csharpier_formats_xml_print_width.md
@@ -0,0 +1,17 @@
+---
+name: csharpier-formats-xml-print-width
+description: CSharpier 1.3.0 formats XML (not just .cs) and enforces its 100-column print width, so an "avoidable reformatting churn" finding on an XML resource can be formatter-mandated and unsatisfiable
+metadata:
+  type: project
+---
+
+CSharpier **1.3.0 in this repo formats `*.xml`, not only `*.cs`**, and enforces its default **100-column print width** on them. `.csharpierignore` excludes `**/evidence/**`, `*.cobertura.xml`, `*.coverage`, `*.coveragexml`, `*.trx`, `*.csproj`, `*.props`, `*.targets` — but **not** `*.xml` generally, so `TaskMaster/Ribbon/RibbonExplorer.xml` is formatter-governed.
+
+**Why:** Issue #503 remediation cycle 1 pinned a finding (F2) asserting that expanding three `<button>` elements from one line to six was "incidental churn with no functional purpose", and required collapsing them back to single-line while keeping a newly added attribute. The collapse passed every scoped gate at 524 lines, then the repo-wide `csharpier check .` failed with CSharpier's *Expected* output showing the six-line form. Arithmetic: the merge-base single-line `<button id="TriageSetA" onAction="TriageSetA_Click" label="Set A" />` is **78 chars**; adding `getEnabled="EngineCommand_GetEnabled"` makes it **116 chars**, over the 100 limit. The multi-line expansion was formatter-mandated, not gratuitous. The plan's own section 3 rule 6 ("CSharpier does not format XML") was false, and the F2 acceptance gate (<= 527 lines) was unsatisfiable while the mandatory format gate must pass.
+
+**How to apply:**
+- Before accepting any plan/review finding that an XML (or other non-`.cs`) reformatting is "avoidable churn", measure the resulting line length against 100 columns and run `csharpier check .` on the candidate form. A scoped gate passing proves nothing; only the repo-wide check does.
+- When a pinned edit turns out to conflict with a mandatory gate mid-execution: **revert the edit**, restore the gate to green, restart the phase per its own loop semantics, and escalate the finding as *not remediable as specified* with the measured arithmetic. Do **not** add the file to `.csharpierignore`, raise `printWidth`, or accept a red format gate — all three are gate-weakening or scope-widening.
+- The only route to shrinking such a file is splitting the resource, which is its own issue.
+
+See also [[project_sln_csproj_edit_crlf_preserve]] and [[project_csharpier_pipefiles_nonenforcing_gate]].
diff --git a/.claude/agent-memory/atomic-executor/project_evidence_timestamp_collision_clobbers_artifacts.md b/.claude/agent-memory/atomic-executor/project_evidence_timestamp_collision_clobbers_artifacts.md
new file mode 100644
index 000000000..906f324c3
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_evidence_timestamp_collision_clobbers_artifacts.md
@@ -0,0 +1,17 @@
+---
+name: evidence-timestamp-collision-clobbers-artifacts
+description: A remediation cycle's <TS> can collide with committed implementation-cycle evidence filenames and silently overwrite them; check git ls-files before writing
+metadata:
+  type: project
+---
+
+Evidence filenames are `<kind>/<name>.<TS>.md`. A **remediation cycle run on the same day** as the implementation cycle can resolve `<TS>` to a value that collides exactly with an already-committed artifact, and the Write tool will **silently overwrite** it — the loss is invisible until `git status --porcelain` shows the path as ` M` (tracked, modified) rather than `??` (untracked).
+
+**Why:** In issue #503 remediation cycle 1, `<TS>` resolved to `2026-08-08T14-52`, which is exactly the timestamp of the committed implementation-cycle artifact `evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md` (its P6-T6 record). The remediation P3-T6 write destroyed it. It was only caught at the P3-T11 scope-lock audit, which classifies porcelain entries and noticed a ` M` under `evidence/` where every other cycle artifact was `??`.
+
+**How to apply:**
+- Before writing the first evidence artifact of a cycle, run `git ls-files '<FEATURE>/evidence'` and compare the planned filenames against the committed set. Same-day cycles are the high-risk case.
+- On collision: restore the original with `git checkout -- <path>` (verify the content came back), then write the new record to a disambiguated name such as `<name>.remediation.<TS>.md`, and record the disambiguation in the artifact body — the plan's stated filename is not worth destroying prior evidence for.
+- Treat any ` M` entry under `evidence/` in a scope-lock audit as a clobber until proven otherwise; cycle artifacts should be `??`.
+
+See also [[project_preflight_mergebase_diff_gates_need_commit_cadence]].
diff --git a/.claude/agent-memory/atomic-executor/project_nullable_build_gate_is_vacuous_incremental.md b/.claude/agent-memory/atomic-executor/project_nullable_build_gate_is_vacuous_incremental.md
new file mode 100644
index 000000000..af5b6c315
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_nullable_build_gate_is_vacuous_incremental.md
@@ -0,0 +1,18 @@
+---
+name: nullable-build-gate-is-vacuous-incremental
+description: The plan-standard `msbuild /t:Build /p:Nullable=enable /p:TreatWarningsAsErrors=true` gate returns EXIT 0 without type-checking, because MSBuild's up-to-date check ignores /p: changes; verify with an isolated /t:Rebuild
+metadata:
+  type: project
+---
+
+The repo-standard type-check gate `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Nullable=enable /p:TreatWarningsAsErrors=true` reports `Build succeeded. 0 Error(s)` in ~1.6 s whenever a prior build (e.g. the analyzer gate) already produced current outputs. MSBuild's up-to-date check compares timestamps only and **ignores `/p:` property changes**, so `CoreCompile` never runs and no nullable analysis happens. The gate is symmetric between baseline and post-change, so it always "passes" — vacuously.
+
+Measured on #503 (2026-08-08): the `/t:Build` form gave 0 errors. A forced
+`msbuild TaskMaster\TaskMaster.csproj /t:Rebuild /p:Configuration=Debug /p:Platform='AnyCPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true /p:BuildProjectReferences=false`
+gave **223 errors** (`CS8600/8601/8602/8603/8604/8618/8619/8625`), concentrated in `TaskMaster\AppGlobals\*` (AppOlObjects 58, AppAutoFileObjects 52, AppToDoObjects 48, AppOlObjects.FolderTreeService 48, AppStagingFilenames 40, ApplicationGlobals 40, AppItemEngines 18). Exactly 3 of the 223 were in newly-authored code.
+
+Do NOT add `/p:OutputPath=<scratch>` to isolate the probe: it also redirects project-reference resolution and produces bogus `CS0006 Metadata file '...QuickFiler.dll' could not be found`. Use `/p:BuildProjectReferences=false` against the normal output path instead, and re-run the full solution build afterwards because `Rebuild` cleans the output.
+
+**Why:** a plan can require "new files must be nullable-clean" and the plan's own command will confirm it without ever checking. Reporting PASS on that basis is an unmeasured claim.
+
+**How to apply:** when a plan's type-check task uses `/t:Build`, execute it verbatim and record its result as the task's stated gate, then run the isolated `/t:Rebuild` as *supplementary verification* scoped to the projects the change touched. Attribute the resulting errors to files (`grep -oE "[A-Za-z0-9_.\\\\]+\.cs\([0-9]+,[0-9]+\): error CS[0-9]+" | sed 's/(.*//' | sort | uniq -c | sort -rn`) and fix only those in authored code; record the rest as pre-existing debt. Related: [[project_incremental_build_vacuous_baseline]].
diff --git a/.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md b/.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
new file mode 100644
index 000000000..7442a446b
--- /dev/null
+++ b/.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
@@ -0,0 +1,21 @@
+---
+name: preflight-mergebase-diff-gates-need-commit-cadence
+description: A plan whose gates read `git diff <MERGE_BASE>..HEAD` is vacuous while HEAD == merge-base and unsatisfiable once HEAD is ahead; preflight must require commit tasks, allow docs/agent-memory paths, and scope later-cycle gates to the commit's own diff
+metadata:
+  type: project
+---
+
+When preflighting a plan whose verification gates are expressed as `git diff --numstat|--name-only <MERGE_BASE>..HEAD` (zero-line-diff / scope-lock / file-size audits), check two things mechanically before signing off:
+
+1. **Does HEAD actually differ from the merge-base by the time the gate runs?** On a freshly branched worktree `git rev-parse HEAD` equals `<MERGE_BASE>`, so every such gate returns an empty diff and passes for the wrong reason. The plan needs explicit commit tasks in the cadence — one after Phase 0 (so planning/baseline artifacts land and HEAD advances), one after the last source-editing phase (so the diff gates observe the real change set), and one at the end (so evidence is committed and the final clean-worktree gate is satisfiable).
+2. **Does the gate's binary outcome tolerate the non-source paths that the commit cadence necessarily introduces?** Committing planning artifacts puts `docs/features/**` and `.claude/agent-memory/**` into the diff. A gate worded "no path outside the scope lock appears" becomes unsatisfiable unless it is narrowed to `.cs`/`.csproj`/`.xml`/`.sln` or explicitly exempts the documentation/evidence trees. Same for a Phase 0 gate demanding a clean `git status --porcelain` when planning artifacts are legitimately uncommitted at that point.
+
+3. **The mirror-image defect on a later cycle: HEAD is now far ahead of the merge-base.** In a remediation or follow-up cycle the branch already carries the implementation commit, so an *unscoped* `git diff --numstat <MERGE_BASE>..HEAD` scope-lock gate enumerates the entire branch (for #503: 18 source paths against a 2-path scope lock) and can never pass. Two distinct fixes, and a plan needs both: audit *scope* against the new commit's own diff (`git show --numstat --format= HEAD`), and audit *protected paths* with a path-scoped `<MERGE_BASE>..HEAD -- <paths>` form so the enclosing branch diff cannot mask a violation. Pair the post-commit check with a pre-commit `git diff --numstat <MERGE_BASE> -- <paths>` (no `..HEAD`) so an uncommitted edit to a protected file is caught before it is committed.
+
+4. **A scope gate must have a bucket for every path `git add -A` will sweep in.** Untracked artifacts carried in from a prior review cycle (audit `.md` files at the feature root, `docs/features/potential/promoted/**`) belong to no phase of the current plan, so a bucketed classification needs an explicit "pre-existing, verified present in the Phase 0 porcelain" bucket. Likewise, if the plan itself emits `.xml` under `<FEATURE>/evidence/`, an extension-based gate ("no `.xml` outside the scope lock") collides with the plan's own output unless it is qualified with "outside `<FEATURE>/evidence/`".
+
+Related consequence: a gate that runs on the *committed* diff after a later mutating step (for example a CSharpier format pass in the final QC phase) measures pre-mutation content. That is acceptable when the mutating step's own argument list is scope-locked, but the plan should say so rather than claim the gate is "post-format".
+
+**Why:** #503 preflight pass 1 (implementation plan) rejected the plan for the vacuous form — empty diff gates plus unsatisfiable clean-worktree gates — and cleared on pass 2 after commit tasks `P0-T13`, `P4-T7`, `P7-T32` were added and the diff-gate wording was widened. The #503 *remediation* plan then hit points 3 and 4 on its own first pass, and cleared once `P4-T4` was split into a path-scoped protected-path check plus a `git show --numstat --format= HEAD` scope check, and `P3-T11` gained the pre-existing-path bucket and the `<FEATURE>/evidence/` qualifier.
+
+**How to apply:** During preflight of any plan with merge-base diff gates, run `git rev-parse HEAD` and `git status --porcelain` in the target worktree, compare against the plan's stated preconditions, and require the commit cadence as a plan delta rather than assuming the executor will commit opportunistically. See [[project_preflight_selfderived_gate_thresholds_are_blind]] for the sibling failure mode (gates that validate against numbers derived from the run being validated).
diff --git a/.claude/agent-memory/atomic-planner/MEMORY.md b/.claude/agent-memory/atomic-planner/MEMORY.md
index 381e8bfc0..f43a033b9 100644
--- a/.claude/agent-memory/atomic-planner/MEMORY.md
+++ b/.claude/agent-memory/atomic-planner/MEMORY.md
@@ -10,8 +10,12 @@
 
 - [Coverage Evidence Path Normalization](evidence-path-normalization.md) — specs sometimes name evidence/coverage/; normalize to canonical baseline/ + qa-gates/
 - [Stale build output is not evidence of existence](stale-build-output-is-not-evidence-of-existence.md) — obj/ cache filenames outlive tear-down commits; verify project/source files with git ls-files or a glob before writing an existence claim into acceptance text
+- [Diff gates need a commit task](diff-gates-need-a-commit-task.md) — `git diff <MERGE_BASE>..HEAD` gates pass vacuously with no commit task; Phase 0 porcelain is non-empty by construction; whitelist docs/ + agent-memory in scope-lock diff gates
 - [Never pin a HEAD SHA as a plan expectation](never-pin-head-sha-as-plan-expectation.md) — record HEAD, gate on tree invariants (clean porcelain + no .cs/.csproj/packages.config/app.config diff vs the baseline-capture sha)
 - [.csharpierignore scope: packages.config is NOT exempt](csharpierignore-scope-packages-config.md) — only *.csproj/*.props/*.targets are excluded; justify single-line package entries by character width, never by formatter exemption
+- [Repo-wide csharpier format breaks zero-diff ACs](csharpier-repowide-format-breaks-zero-diff-acs.md) — scope the mutating pass to the plan's own path list; keep `check .` read-only; re-verify the zero-line diff AFTER formatting
+- [Embedded-resource fail-proof needs a rebuild gate](embedded-resource-failproof-rebuild-gate.md) — edit → rebuild → assert embedded bytes → `[expect-fail]` run; skipping the assert makes the fail-proof itself vacuous
+- [#503 ribbon readiness plan seams](project_503_ribbon_readiness_plan_seams.md) — RibbonViewer 487/500 forces a 26-member region move; 6+4 Compile entries; compile-time red + dossier; #504-#508 already promoted
 - [CSharpier gate: format not pipe-files](csharpier-format-not-pipe-files-gate.md) — formatting tasks must use `csharpier format` + scoped `csharpier check` exit 0; `pipe-files` is stdout-only/non-enforcing and masked a 500-line overflow in #400
 - [#400 partial-class headroom placement](project_400_partial_class_headroom_placement.md) — put new coverage cases in existing `.Part2.cs` `[TestClass] partial` files to keep the 17-class filter/count assertions stable
 - [Manager AsyncLazy shared seam](project_manager_asynclazy_shared_seam.md) — Globals.AF.Manager is shared across all classifier subsystems; use a key-specific accessor, never retype the dictionary value for one key
diff --git a/.claude/agent-memory/atomic-planner/csharpier-repowide-format-breaks-zero-diff-acs.md b/.claude/agent-memory/atomic-planner/csharpier-repowide-format-breaks-zero-diff-acs.md
new file mode 100644
index 000000000..d23a83dae
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/csharpier-repowide-format-breaks-zero-diff-acs.md
@@ -0,0 +1,12 @@
+---
+name: csharpier-repowide-format-breaks-zero-diff-acs
+description: A repo-wide `csharpier format .` in a final-QC phase can silently violate a zero-line-diff acceptance criterion; scope the mutating pass to the plan's own file list and keep `csharpier check .` as the read-only gate
+metadata:
+  type: feedback
+---
+
+When a plan carries a zero-line-diff acceptance criterion for specific files (an R4-style "do not touch `X.cs`" constraint), the final-QC formatting task must run `csharpier format` with an EXPLICIT scope-locked path list, never `csharpier format .`. The repo-wide read-only `csharpier check .` stays as the gate, with acceptance expressed as "exit 0, OR the reported unformatted set is exactly the merge-base set captured in Phase 0 and contains none of the scope-locked paths".
+
+**Why:** `csharpier format .` rewrites every file that is unformatted at the merge-base, not just the files the change touched. If any protected file happens to be unformatted at merge-base, the format pass silently produces a diff on it and converts the zero-line-diff AC from PASS to FAIL — after the executor has already recorded a clean toolchain pass. Encountered while planning #503 (2026-08-08), where AC15 requires a literal zero-line diff on `TaskMaster/AppGlobals/AppItemEngines.cs` and `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs` and the merge-base csharpier state was unmeasured.
+
+**How to apply:** (1) Add a Phase 0 task that runs `csharpier check .` read-only and records the merge-base unformatted-file set verbatim — this is the comparison basis, not just a pass/fail. (2) Add a Phase 0 task that derives the formatting-scope rule and records whether any protected file is in that set. (3) Name the scope-locked `.cs` path list once in the plan and paste it into the `csharpier format` command. (4) Re-verify the zero-line diff AFTER the format pass, not only before it — a second `git diff --numstat <merge-base>..HEAD` task at the end of the QC phase. Related: [[csharpier-format-not-pipe-files-gate]], [[feedback_postformat_file_size_audit]].
diff --git a/.claude/agent-memory/atomic-planner/diff-gates-need-a-commit-task.md b/.claude/agent-memory/atomic-planner/diff-gates-need-a-commit-task.md
new file mode 100644
index 000000000..58af58a78
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/diff-gates-need-a-commit-task.md
@@ -0,0 +1,18 @@
+---
+name: diff-gates-need-a-commit-task
+description: A plan whose gates use `git diff <MERGE_BASE>..HEAD` passes vacuously unless the plan itself contains explicit commit tasks; and an "empty porcelain" Phase 0 acceptance is unsatisfiable when planning artifacts are already uncommitted
+metadata:
+  type: feedback
+---
+
+Any plan gate expressed as `git diff --numstat <MERGE_BASE>..HEAD` or `git diff --name-only <MERGE_BASE>..HEAD` verifies NOTHING unless the plan contains explicit commit tasks that advance HEAD past the merge-base. Pair every diff-based gate with a commit task earlier in the plan.
+
+**Why:** #503 preflight (delta B1). The plan carried three diff-based gates (AC15 zero-line diff at P5-T1, the 500-line audit at P6-T3, and the post-format re-verification at P6-T10) but had no commit task anywhere. `git rev-parse HEAD` equalled the merge-base for the entire execution, so all three gates returned empty output and passed vacuously. Separately, Phase 0 asserted "an empty `git status --porcelain`" while 16 uncommitted lines of planning artifacts already existed, and Phase 0's own evidence tasks would add more — an unsatisfiable acceptance.
+
+**How to apply:** Three rules when writing a plan with diff or worktree gates.
+
+1. **Commit cadence.** Put a commit task at the end of Phase 0 (planning artifacts + baseline evidence), at the end of the last implementation phase (all source/test changes), and inside the final worktree-clean task. Each is a normal task with `EXIT_CODE: 0` and an evidence artifact under `<FEATURE>/evidence/`.
+2. **Phase 0 porcelain is non-empty by construction.** Never write "empty `git status --porcelain`" as a Phase 0 acceptance. Record the verbatim output and make the binary outcome a *type* assertion instead: no `.cs`, `.csproj`, `.xml`, or `.sln` path appears. Docs/evidence/agent-memory paths are expected.
+3. **Scope-lock diff gates must whitelist docs.** Once commits exist, the diff legitimately contains `docs/features/` and `.claude/agent-memory/` paths. Phrase the gate as "every path is a scope-lock member OR under docs/evidence" and keep the hard clause on source extensions only. In a companion file-size audit, state that Markdown docs are exempt from the 500-line cap per `.claude/rules/general-code-change.md`.
+
+Related: [[never-pin-head-sha-as-plan-expectation]] — the fix is commit tasks plus tree-invariant gates, never a pinned SHA equality check.
diff --git a/.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md b/.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md
new file mode 100644
index 000000000..d41ed1adf
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md
@@ -0,0 +1,19 @@
+---
+name: embedded-resource-failproof-rebuild-gate
+description: Fail-proof mutations of an embedded resource need edit -> rebuild -> assert-embedded-bytes -> run-test; without the assert step the "failing" run silently passes against a stale assembly
+metadata:
+  type: feedback
+---
+
+When a plan proves a test non-vacuous by temporarily mutating an **embedded resource** (e.g. `TaskMaster\Ribbon\RibbonExplorer.xml`, read via `assembly.GetManifestResourceStream(...)`), the mutation is invisible to the test until the owning assembly is rebuilt and re-copied into the test output directory. Structure the phase as four separate tasks: edit → rebuild → **assert the embedded byte content** → run the `[expect-fail]` test. Make the assert step a hard gate with an explicit `/t:Rebuild` fallback, and make the restoration (`git checkout -- <path>`) its own verified task.
+
+Assert the embedded content from a byte-loaded assembly so no file lock blocks the next rebuild:
+
+```powershell
+$asm = [System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($dll))
+$text = (New-Object System.IO.StreamReader($asm.GetManifestResourceStream($resourceName))).ReadToEnd()
+```
+
+**Why:** Without the assert step, an edit-then-run sequence reads a stale assembly and reports Pass. That converts the fail-proof itself into a second vacuous check — exactly the defect the cycle exists to remove (#503 F1, remediation cycle 2026-08-08T14-26). `LoadFrom` would lock the DLL and break the subsequent rebuild.
+
+**How to apply:** Any `[expect-fail]` task whose subject is a resource, embedded asset, satellite file, or generated artifact rather than a `.cs` file. Also choose a mutation target that is already in the shape you want (a whole-line deletion from an already-multi-line element) so the mutation's `git diff --numstat` gate is exactly `0 1` and does not entangle with a sibling finding's edit. Related: [[diff-gates-need-a-commit-task]], [[project-503-ribbon-readiness-plan-seams]].
diff --git a/.claude/agent-memory/atomic-planner/project_503_ribbon_readiness_plan_seams.md b/.claude/agent-memory/atomic-planner/project_503_ribbon_readiness_plan_seams.md
new file mode 100644
index 000000000..e47614602
--- /dev/null
+++ b/.claude/agent-memory/atomic-planner/project_503_ribbon_readiness_plan_seams.md
@@ -0,0 +1,19 @@
+---
+name: project-503-ribbon-readiness-plan-seams
+description: '#503 ribbon engine-readiness guard planning facts: RibbonViewer 487/500 forces a partial split, 6+4 csproj Compile entries, compile-time red, #504-#508 already promoted'
+metadata:
+  type: project
+---
+
+Planning facts verified on the `bug/ribbon-engine-readiness-guard-503` worktree (2026-08-08), merge-base `003c5715`:
+
+- `TaskMaster\Ribbon\RibbonViewer.cs` is 487/500 lines and is NOT `partial`. New ribbon callbacks cannot be added in place; the `#region Spam Manager` (250-296) and `#region Triage` (298-347) blocks must relocate into a new partial. The move carries 26 members, not just the 8 defective handlers.
+- New files need 6 `<Compile Include>` entries in `TaskMaster\TaskMaster.csproj` (ItemGroup at line 459) and 4 in `TaskMaster.Test\TaskMaster.Test.csproj` (ItemGroup at line 311). Both are packages.config/non-SDK.
+- Namespace is flat `TaskMaster` (not `TaskMaster.Ribbon`); tests are `TaskMaster.Test.Ribbon`. `IAppItemEngines`, `IConditionalEngine<T>`, `MailItemHelper` are all in `UtilitiesCS`.
+- `coverage.config` excludes only Deedle/FSharp/Castle/FluentAssertions/Moq/MSTest modules, so `TaskMaster.dll` IS instrumented and per-type Cobertura line-rate assertions on new `TaskMaster.*` types are measurable.
+- The bugfix red is necessarily a COMPILE-time red: the unit under test does not exist at merge-base, and the defective path lives in `[ExcludeFromCodeCoverage]` COM-bound `RibbonViewer` handlers whose `SB`/`Triage` getters install a real `WindowsFormsSynchronizationContext` side effect. Pair the `[expect-fail]` build artifact with a `fail-before-exception.<TS>.md` dossier.
+- The repo has no non-modal notification surface; `MessageBox.Show` + log4net is the established user-facing notice mechanism in `RibbonViewer`/`RibbonController`. Pin this as a recorded decision rather than inventing a status bar.
+
+**Why:** These were each a potential preflight finding (unsatisfiable line cap, files that do not compile, unmeasurable coverage AC, ambiguous red, invented UI surface).
+
+**How to apply:** Reuse directly for any follow-up on #504-#507 (orphan `onAction` callbacks, invalid `getPressed` signatures, fire-and-forget `ToggleEngineAsync`, non-null-safe `RibbonController.Engines`) — those are already promoted issues and must not be fixed inside #503. `#508` is the pre-existing `YieldAsync_WithoutDispatcher_RemainsStrict` order-dependent flake; the merge-base suite is 6293 tests and NOT green. Related: [[legacy-csproj-explicit-compile-include]], [[csharpier-repowide-format-breaks-zero-diff-acs]].
diff --git a/.claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md b/.claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md
index 7c797e8e3..56cad9f68 100644
--- a/.claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md
+++ b/.claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md
@@ -18,3 +18,11 @@ In a legacy non-SDK project, a `<ProjectReference>` does NOT flow the referenced
 **Why:** Caught during #418 preflight. `SVGControl.Test.csproj` had a `ProjectReference` to `SVGControl` but no `<Reference Include="Svg" ...>` and no `Svg` entry in its own `packages.config`; every planned test named `SvgDocument`, so the whole test file would have failed with `CS0012` for `Svg, Version=3.4.0.0`.
 
 **How to apply:** Before planning tests in a legacy test project, grep that project's own `.csproj` `<Reference>` block and `packages.config` for every third-party type the tests will name. If a type comes only from the production project's package set, add an explicit task that adds BOTH the `packages.config` `<package id=... />` entry and the `<Reference Include=... ><HintPath>..\packages\<id>.<ver>\lib\<tfm>\<dll>.dll</HintPath></Reference>` item, copying the exact `Version=`/`PublicKeyToken=` from the production project's csproj. Widen the scope-lock entry for that csproj to permit `<Reference>` items, and add the `packages.config` unconditionally.
+
+### Corollary: assert by `ParameterType.FullName`, not `typeof(...)`, when the scope lock forbids adding the reference
+
+`TaskMaster.Test.csproj` carries only `Microsoft.Office.Interop.Outlook`; it has NO `<Reference Include="Office, Version=15.0.0.0 ...">` (the Office Core PIA that supplies `Microsoft.Office.Core.IRibbonControl`), even though `TaskMaster.csproj` does. So a reflection test that writes `typeof(Microsoft.Office.Core.IRibbonControl)` fails to compile in the test project.
+
+**Why:** Caught in #503 preflight (delta B3). The plan's scope lock deliberately restricted `TaskMaster.Test.csproj` to four `<Compile Include>` entries, so adding a `<Reference>` mid-execution would have breached the scope lock; the fix was to weaken the assertion, not widen the scope.
+
+**How to apply:** When a signature-shape assertion needs a type the test project cannot reference, and adding the reference would breach the plan's own scope lock, pin the assertion to `method.GetParameters()[0].ParameterType.FullName == "<literal namespace-qualified name>"` and state in the task text WHY `typeof` is prohibited. This works because the assembly (e.g. `office.dll`) is present in `bin\Debug\` and the GAC at runtime even though it is absent from the compile-time reference set. Choose deliberately between the two remedies — widening the scope lock is the alternative, and the plan must say which one it took.
diff --git a/.claude/agent-memory/feature-review/MEMORY.md b/.claude/agent-memory/feature-review/MEMORY.md
index 528156e6e..83ab92bef 100644
--- a/.claude/agent-memory/feature-review/MEMORY.md
+++ b/.claude/agent-memory/feature-review/MEMORY.md
@@ -3,7 +3,8 @@
 - [powershell-coverage-mandatory-when-ps1-in-diff](feedback_powershell-coverage-gate.md) — validate-feature-review-coverage hook blocks termination without an explicit PASS/FAIL PowerShell coverage verdict when .ps1 files changed
 - [pr-context-summary-misclassifies-cs](project_pr-context-summary-misclassifies-cs.md) — PR-context summary overview can mislabel C# changes as docs ("0 core logic files"); always verify scope against git diff
 - [coverage-hook-trusts-misclassified-summary](project_coverage-hook-trusts-misclassified-summary.md) — the coverage hook reads changed languages from the summary overview, not git diff; a C#-as-docs misclassification makes it silently skip C# coverage enforcement
-- [csharp-coverage-artifact-is-cobertura](project_csharp-coverage-artifact-is-cobertura.md) — `artifacts/csharp/coverage.xml` is Cobertura; the hook parses it as JaCoCo and gets $null repo-wide, so the reviewer must parse it manually
+- [csharp-coverage-artifact-is-cobertura](project_csharp-coverage-artifact-is-cobertura.md) — `artifacts/csharp/coverage.xml` format VARIES (Cobertura / VS .coverage / JaCoCo); read the root element first — `<report>` means the hook works and sub-85/sub-75 enforcement is live
+- [csharpier-formats-xml-probe-verification](project_csharpier-formats-xml-probe-verification.md) — CSharpier 1.3.0 formats `*.xml` (no `.csharpierrc` so width=100, `.csharpierignore` lacks `*.xml`); reproduce a "formatter mandated this" escalation with a scratch probe file rather than accepting it
 - [csharp-local-fullsuite-coverage-blocked](project_csharp-local-fullsuite-coverage-blocked.md) — local full-assembly C# coverage fails on a Moq binding redirect; per-feature Cobertura is trimmed to affected classes (no repo-wide root), so repo-wide gate is the PR CI run
 - [csharp-repowide-coverage-below-80](project_csharp-repowide-coverage-below-80.md) — raw all-DLL Cobertura merges read ~59-69% (vendor-inflated denominator); canonical first-party figures (Koverage ~79.4%, or manual by-name package exclusion ~91.22% per #253) both clear 80%/85%
 - [feature-audit check-off heading case](feature-audit-checkoff-heading-case.md) — validator needs `## Acceptance Criteria Check-off` (lowercase off); template ships `Check-Off` and fails
@@ -52,3 +53,6 @@
 - [verify parity claims in remediation inputs](feedback_verify-parity-claims-in-remediation-inputs.md) — #418: my "parity with the eight sibling test projects" Fizzler directive was false on disk and the executor rightly refused; measure every parity claim, and check app.config redirect vs on-disk package version
 - [verify the asserted evidence mechanism](feedback_verify-asserted-evidence-mechanism.md) — #418 R4: a capture's "proven by unit tests" was false (zero Trace/log4net refs in the test project); 100% coverage on a logging member is not assertion — grep the mechanism, correct the basis, keep the PASS
 - [maintainer waiver hides in gitignored state](project_maintainer-waiver-recorded-only-in-gitignored-state.md) — #418 R4: coverage waivers land in the gitignored orchestrator-state.json and never reach the PR; run `git check-ignore`, require transcription into issue.md, and never convert a threshold waiver into an ExcludeFromCodeCoverage exclusion
+- [two vstest binaries: binding-redirect trap](project_two-vstest-binaries-binding-redirect.md) — #503: the TestWindow vstest.console.exe drops the app.config redirect and fakes 26 Moq failures; use Extensions\TestPlatform + /Settings:TaskMaster.runsettings
+- [package-counter delta proves new-type coverage](project_package-counter-delta-corroborates-new-type-coverage.md) — #503: when per-class detail is stripped to JaCoCo summaries, an unchanged package `missed` with `covered` up by exactly the new types' line total proves both the new-code floor and changed-line no-regression
+- [mandated nullable solution gate is vacuous](project_nullable_build_gate_is_vacuous.md) — #503: /t:Build with only /p: changes skips CoreCompile so the gate cannot fail; force /t:Rebuild on the changed project and attribute the errors by file
diff --git a/.claude/agent-memory/feature-review/project_csharp-coverage-artifact-is-cobertura.md b/.claude/agent-memory/feature-review/project_csharp-coverage-artifact-is-cobertura.md
index a984d0171..d93fb79dd 100644
--- a/.claude/agent-memory/feature-review/project_csharp-coverage-artifact-is-cobertura.md
+++ b/.claude/agent-memory/feature-review/project_csharp-coverage-artifact-is-cobertura.md
@@ -13,6 +13,8 @@ The canonical C# coverage artifact `artifacts/csharp/coverage.xml` is **Cobertur
 
 **Third format variant — a genuine JaCoCo conversion, which the hook CAN read (Issue #418, 2026-08-04):** `artifacts/csharp/coverage.xml` was 291 bytes of real JaCoCo: `<report name="TaskMaster C# (converted from Cobertura)"><sessioninfo .../><counter type="LINE" missed="16002" covered="93484" /><counter type="BRANCH" missed="5878" covered="21528" /></report>`. `Get-JacocoRepoCoverage` and `Get-JacocoBranchCoverage` both resolve it (85.38% / 78.55%), so on this variant the hook's sub-85 "must carry FAIL" check AND its unconditional sub-75 branch block are both LIVE. Do not assume the C# row is unenforced — simulate the hook (dot-source it, run `Get-ChangedLanguageSet` + `Get-LanguageRepoCoverage` + `Get-LanguageBranchCoverage` + `Test-LanguageCoverageRow`) against your draft before finalizing. The counters matched the source `coverage/coverage.cobertura.xml` root attributes exactly, so the conversion was faithful and needed no manual re-derivation — but verify that match rather than assuming it.
 
-**How to apply:** Do not rely on the hook to compute the real C# repo-wide figure. Parse `artifacts/csharp/coverage.xml` yourself: for Cobertura, repo-wide is the root `line-rate` attribute and per-file is `<line hits>` aggregated by class `filename`; for the VS `.coverage` XML, read `line_coverage` attributes on `<module>`/`<function>` nodes. The reviewer owns the actual PASS/FAIL coverage judgment. See [[pr-context-summary-misclassifies-cs]].
+**JaCoCo variant confirmed again, with per-package counters (Issue #503, 2026-08-08):** `artifacts/csharp/coverage.xml` was JaCoCo with **one `<counter>` pair per `<package>`** (9 packages: QuickFiler, UtilitiesCS, TaskVisualization, SVGControl, ToDoModel, Tags, TaskMaster, TaskTree, VBFunctions) and **no root-level aggregate**. Because `Get-JacocoRepoCoverage` sums *all* `//counter[@type="LINE"]` nodes, per-package-only files aggregate correctly — it read 85.86% line / 79.27% branch, matching a hand computation exactly. Both the sub-85 FAIL requirement and the unconditional sub-75 branch block are LIVE on this shape. Bonus: per-package counters alone can prove new-code coverage — see [[project_package-counter-delta-corroborates-new-type-coverage]].
+
+**How to apply:** Read the root element before parsing — `<report>` is JaCoCo (hook works, enforcement live), `<coverage line-rate=...>` is Cobertura, `<results><modules>` is VS `.coverage` XML (hook returns `$null` on both of the latter). Do not rely on the hook to compute the real C# repo-wide figure on the non-JaCoCo shapes. Parse `artifacts/csharp/coverage.xml` yourself: for Cobertura, repo-wide is the root `line-rate` attribute and per-file is `<line hits>` aggregated by class `filename`; for the VS `.coverage` XML, read `line_coverage` attributes on `<module>`/`<function>` nodes. The reviewer owns the actual PASS/FAIL coverage judgment. See [[pr-context-summary-misclassifies-cs]].
 
 For Issue #171 the repo-wide C# line-rate was 57.99%, below 80%, but that is a documented pre-existing COM/WinForms condition (oversized controllers ~3-7% covered, not unit-testable without live Outlook). The governing change-scope gates (>= 90% new module; no changed-line regression) were met, so the verdict was PASS with a pre-existing-condition justification.
diff --git a/.claude/agent-memory/feature-review/project_csharpier-formats-xml-probe-verification.md b/.claude/agent-memory/feature-review/project_csharpier-formats-xml-probe-verification.md
new file mode 100644
index 000000000..edb22dd20
--- /dev/null
+++ b/.claude/agent-memory/feature-review/project_csharpier-formats-xml-probe-verification.md
@@ -0,0 +1,29 @@
+---
+name: csharpier-formats-xml-probe-verification
+description: CSharpier 1.3.0 formats XML in TaskMaster (no .csharpierrc so width=100, .csharpierignore lacks *.xml); reproduce a "formatter mandated this layout" claim with a scratch probe file instead of accepting it
+metadata:
+  type: project
+---
+
+CSharpier 1.3.0 in TaskMaster formats `*.xml`, not just `*.cs`. `.csharpierignore` excludes
+`**/evidence/**`, `*.cobertura.xml`, `*.coverage`, `*.coveragexml`, `*.trx`, `*.csproj`, `*.props`,
+`*.targets` — but **not** `*.xml` generally. There is no `.csharpierrc` anywhere in the repo, so the
+default print width of **100 columns** applies to ribbon XML.
+
+**Why:** #503 cycle 1 asked the executor to collapse three `<button>` elements in
+`TaskMaster/Ribbon/RibbonExplorer.xml` back to single-line form to reduce line count. The executor
+reported it "not remediable" and escalated. That is a claim a reviewer must not take on trust — it is
+exactly the shape of an excuse for skipping requested work.
+
+**How to apply:** reproduce it, do not reason about it. Write a minimal `customUI` document into the
+scratchpad containing the collapsed element next to a short sibling, then run
+`csharpier check <probe>.xml`. In #503 this returned `Error - Was not formatted` and CSharpier's
+"Expected" block expanded **only** the 116-character element while leaving the 78-character sibling
+single-line — proving the multi-line form is formatter-mandated rather than incidental churn. The
+merge-base single-line `<button>` is 78 chars; adding `getEnabled="EngineCommand_GetEnabled"` makes
+it 116, over the 100 limit.
+
+Corollary: a line-count reduction target for ribbon XML is unreachable while `csharpier check .`
+must return 0. The only real route is splitting the resource, which is its own issue.
+
+Related: [[project_two-vstest-binaries-binding-redirect]], [[project_nullable_build_gate_is_vacuous]].
diff --git a/.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md b/.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md
new file mode 100644
index 000000000..ace2ce025
--- /dev/null
+++ b/.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md
@@ -0,0 +1,20 @@
+---
+name: nullable_build_gate_is_vacuous
+description: TaskMaster's mandated type-check gate (msbuild /t:Build with /p:Nullable=enable) cannot fail, because MSBuild skips CoreCompile when only /p: values change; force /t:Rebuild on the changed project to get a real signal.
+metadata:
+  type: project
+---
+
+CLAUDE.md CUT3 step 3 is `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`. It reliably returns EXIT 0 — including on a tree with hundreds of real `CS86xx` nullable errors — because MSBuild's up-to-date check skips `CoreCompile` when only `/p:` property values change relative to the last build. A green result from that command proves nothing about nullability.
+
+Real signal on #503 (2026-08-08), from `msbuild TaskMaster\TaskMaster.csproj /t:Rebuild /p:Configuration=Debug /p:Nullable=enable /p:TreatWarningsAsErrors=true`:
+
+- EXIT 1, 195 errors, 64 of them `CS86xx`
+- top offenders, all untouched: `OutlookItemTry.cs` 35, `OutlookItemFlaggableTry.cs` 30, `ItemInfo.cs` 20, `PropertyStore.cs` 17, `SubjectMapEntry.cs` 14, `BayesianClassifier.cs` 13
+- **zero** errors in any file authored by the feature under review
+
+Note the platform trap: at project level, `/p:Platform='Any CPU'` fails with `The BaseOutputPath/OutputPath property is not set`. Omit `/p:Platform` entirely for a single-project rebuild. (Solution level still needs `Any CPU`.) See [[msbuild-invocation-via-bash]].
+
+**Why:** Reporting the solution gate as a PASS without qualification overstates the evidence; reporting the forced-rebuild error count as a feature FAIL wrongly blames the change for pre-existing repository debt. Both are wrong.
+
+**How to apply:** Run the mandated command (it is the policy gate and its EXIT 0 is the DoD fact), then run the forced project rebuild and attribute the errors by filename. Grade the type-check PASS when zero errors are attributable to authored files, and raise the gate's vacuity as a separate governance finding. On #503 the executor had already found and recorded this in `evidence/qa-gates/msbuild-nullable.<ts>.md` and routed it for promotion, so check the evidence tree before treating it as a new discovery. Related but distinct: [[langversion-missing-test-projects-cs8630]] (#418), where test projects default to C# 7.3 and `/p:Nullable=enable` fails outright.
diff --git a/.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md b/.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md
new file mode 100644
index 000000000..5dd1a1929
--- /dev/null
+++ b/.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md
@@ -0,0 +1,20 @@
+---
+name: package-counter-delta-corroborates-new-type-coverage
+description: When per-class coverage detail has been stripped from committed evidence, a package-level missed/covered delta between the baseline and final JaCoCo summaries can still prove new-code coverage and changed-line no-regression.
+metadata:
+  type: project
+---
+
+TaskMaster feature evidence is trending toward committing package-level JaCoCo summaries instead of full Cobertura reports (on #503, commit `d0955dc4` replaced two ~10 MB / ~187k-line Cobertura files with 39-line JaCoCo summaries). That removes exactly the per-class detail that the per-type (`>= 90%` new module) and per-file (no changed-line regression) acceptance criteria assert against, so the executor's tabulated per-type numbers become unverifiable from committed artifacts alone.
+
+The package-counter delta recovers both claims without rerunning coverage. Diff the baseline and final `<counter type="LINE">` for the package containing the new code:
+
+- On #503 the `TaskMaster` package went `missed=1464 covered=3329` -> `missed=1464 covered=3515`.
+- `covered` rose by exactly 186, which is the exact line total of the four new types (48+48+72+18) reported in `new-type-coverage.<ts>.md`.
+- `missed` did not move at all.
+
+Both facts together are decisive: had ANY of the 186 new lines been uncovered, `missed` must have risen; and since `missed` is unchanged, no previously-covered line in that package lost coverage either. That proves the new-code floor AND the changed-line no-regression gate from a 39-line artifact.
+
+**Why:** Grading such an AC UNVERIFIED because the named artifact lost granularity would be both unhelpful and wrong — the substance is provable. Grading it PASS on the executor's word alone would be unverified deference.
+
+**How to apply:** Compute this delta before accepting or rejecting a per-type coverage claim whose source artifact was summarized. Record it explicitly as an independent corroboration route in the policy audit, and separately record the evidence-durability regression as a Low finding recommending the summariser retain per-class counters for changed files. Note the branch counter usually will NOT be this clean (on #503 `BRANCH` missed rose 387->389 while covered rose +62), so attribute branch deltas cautiously. See [[csharp-coverage-artifact-is-cobertura]] for the related format trap.
diff --git a/.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md b/.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
index 811fe12bd..99112517c 100644
--- a/.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
+++ b/.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
@@ -5,7 +5,7 @@ metadata:
   type: project
 ---
 
-The automated `artifacts/pr_context.summary.txt` "Changed files overview" classifier has recurred at least five times: Issue #171 (2026-06-02) reported `Core logic changes: 0 files` while the diff had 9 C# production + 7 test + 4 `.csproj` files; Issue #181 (2026-06-08) reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 26 files" while the diff had 31 C# build-config files (15 `.csproj`, 15 `packages.config`), a new `BannedSymbols.txt`, and a +567-line `.editorconfig`; Issue #244 (2026-07-06) reported `Core logic changes: 0 files` while the actual changed-files enumeration **omitted the 3 changed C# files entirely** (not even mislabeled into the "Docs/templates/agents/tooling" bucket — they simply do not appear in any per-file `(+N/-M)` line in the summary, only in the appendix's raw diffstat), even though the two `.cs` files individually carried the largest line-count deltas (+212, +31) of any file in the diff; Issue #251 (2026-07-07) reported the same `Core logic changes: 0 files` / omission pattern for a 2-file (`QfcCollectionController.cs`, one new test file) diff; Issue #253 (2026-07-07) again reported `Core logic changes: 0 files` for a diff whose only production+test change was 2 `.cs` files, with the appendix's own "Files by extension" section (`2 .cs`) directly contradicting the summary's overview in the same artifact; Issue #270 (2026-07-07) reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 24 files" for a diff with 1 C# production file + 3 C# test files + 1 `.csproj` (the `.cs`/`.csproj` files omitted from the overview, listed only in the appendix). Issue #278 (2026-07-08) again reported `Core logic changes: 0 files` for a 2-file `.cs` diff (`PhysicalFileInfoAdapter.cs` + its test), with both files omitted from the overview entirely (they appear only inside quoted plan/evidence excerpts elsewhere in the summary, never as an overview bullet); corrected via a direct `Edit` adding a `Core logic changes: 2 files` block with `(+11/-3)`/`(+32/-18)` bullets sourced from `git diff --numstat -- '*.cs'`, labeled `CORRECTION (feature-review, <date>):` rather than the `[STALE-EVIDENCE CORRECTION]` tag used on #244 — either label works, what matters is that the corrected block uses the exact `- <path> (+N/-N)` bullet shape the hook's regex requires. Issue #283 (2026-07-08) is the same flat-omission variant but with a NON-ZERO `Core logic changes: 3 files` count (3 PowerShell `.ps1` files listed) while all 4 C# changes (`LiveOutlookHarnessRunner.cs` +139, its test +172, the modified integration test +66/-85, `TaskMaster.Test.csproj` +2) plus `.github/workflows/ci.yml` were omitted from the overview entirely — do NOT rely on the "0 files" symptom as the tell, since a non-zero count for one language can still hide a fully-omitted second language; corrected via an `Edit` rewriting the block to `Core logic changes: 8 files` with the `.cs`/`.csproj`/`.yml` bullets from `git diff --numstat`. Issue #208 (2026-07-09) again reported `Core logic changes: 0 files` for a bug fix whose diff had 5 C# files (new `TaskMaster/Logging/LogDirectoryInitializer.cs` +139, new test +201, `ThisAddIn.cs` +31, and two `.csproj` Compile-include lines); all 5 omitted from the overview and listed only in the docs/tooling bucket for the docs and in the appendix; corrected in place with a timestamped note plus a `Core logic changes: 5 files` bullet block using the exact `- <path> (+N/-N)` shape. Issue #292 (2026-07-09) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 19 files" for a bug fix whose diff had 3 C# production files (`StoresWrapper.cs` +22/-2, `CurrentStoreContext.cs` +9, `StoreLockupResponder.cs` +26) + 2 C# test files + 1 `.csproj`; all 6 omitted from the overview (only docs `.md` bullets appeared), corrected in place with a timestamped `CORRECTED BY FEATURE-REVIEW` note plus `Core logic changes (C#): 3 production files` and `Tests / project wiring (C#): 3 files` blocks using the exact `- <path> (+N/-N)` shape. Issue #328 (2026-07-15) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 20 files" for a full-feature store-exclusion change whose diff had 15 C# production files (`StoresWrapper.cs`, new `StoresWrapper.Filtering.cs`, `StoreFilterAttribution.cs`, `StoreWrapper.cs`, `StoreWrapperController.cs`, the viewer trio, 3 `ToDoModel` sites, 3 `TaskMaster` callers) + 8 C# test files + 4 `.csproj`; all `.cs` omitted from the overview (only 10 docs/evidence `.md`/`.xml` bullets appeared), corrected in place with a `CORRECTED BY feature-review` note plus a `Core logic changes (C# production): 15 files` block using the exact `- <path> (+N/-N)` shape — and note that the paths under `ToDoModel/Data Model/...` contain a SPACE, so those bullet lines are silently skipped by the hook's `^\s*-\s+(\S+)\s+\(\+\d+/-\d+\)\s*$` regex (the `\S+` path token cannot contain a space); listing the space-free `UtilitiesCS/OutlookObjects/Store/*.cs` bullets is what makes `Get-ChangedLanguageSet` enumerate CSharp. Issue #418 (2026-08-04) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 40 files" for a bug fix whose diff had 2 C# production files (`SVGControl/SvgRenderer.cs` +167/-24, new `SVGControl/SvgAssemblyProbe.cs` +67) + 3 new C# test files + 2 `.csproj` + `app.config` + `packages.config` + `TaskMaster.sln`; all 10 omitted from the overview (only 10 docs `.md` bullets appeared), corrected in place with a `NOTE (corrected by feature-review <ts>)` block plus a `Core logic changes: 10 files` bullet list. Two other collector defects co-occurred on #418 and are worth checking together: the summary falsely reported "GitHub CLI (gh) is not installed" (a PATH-resolution false negative; gh 2.87.3 was installed and on PATH), and its author-asserted auto-close list was polluted with `#419` (the merged package-update PR the branch rebased onto), `#AC-1`..`#AC-11` (acceptance-criteria labels lifted from commit messages), and `#DE06-4337` (a fragment of the new project GUID `{13AC39E6-DE06-4337-8EB0-41CE674A4C3B}` added to `TaskMaster.sln` — any `.sln` addition will produce this class of phantom issue reference). On the #418 **cycle-3 reaudit** (2026-08-05, head `69e675d0`) the regenerated summary reproduced the identical defect a third time on the same feature — `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 104 files" against a diff with 6 `.cs` + 2 `.csproj` + 2 `.config` + 1 `.sln` — so a regeneration at a new head does NOT fix it and the correction must be re-applied every cycle. The `#DE06-4337` GUID-fragment and `#AC-1..#AC-11` phantom close candidates recurred verbatim too. The misclassification is especially likely for C# build-config-only changes (csproj/packages.config/editorconfig) and, per #244/#251/#253/#283/#208/#292/#328, most often now manifests as flat omission (the summary's own docs-file count exactly matches the non-`.cs` file total, meaning the `.cs` files are dropped rather than relabeled) rather than mislabeling into a wrong bucket. Record it under `## Rejected Scope Narrowing` in the policy audit and proceed with the full diff scope regardless. Issue #424 (2026-08-06) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 36 files" for a bug fix whose diff had 6 C# production files + 8 C# test files + 2 `.csproj` (all space-free QuickFiler paths, all omitted from the overview; only docs/evidence `.md`/`.xml` bullets appeared); corrected in place with a bracketed correction note plus a `Core logic changes: 16 files` bullet list in the exact `- <path> (+N/-N)` shape. This is now a near-certain-per-review defect for any C#-touching feature — check for it every time without waiting for a symptom. Issue #230 (2026-08-07) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 30 files" for a full-feature diff with 2 C# production files + 7 test files + 1 `.csproj` (all space-free paths, all omitted from the overview — only the 10 largest docs/evidence `.md`/`.xml` bullets appeared); corrected in place by replacing the `Core logic changes: 0 files` line with a `Core logic changes: 10 files` annotated bullet block from `git diff --numstat`, after which the dot-sourced hook simulation enumerated `CSharp` and returned OK.
+The automated `artifacts/pr_context.summary.txt` "Changed files overview" classifier has recurred at least five times: Issue #171 (2026-06-02) reported `Core logic changes: 0 files` while the diff had 9 C# production + 7 test + 4 `.csproj` files; Issue #181 (2026-06-08) reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 26 files" while the diff had 31 C# build-config files (15 `.csproj`, 15 `packages.config`), a new `BannedSymbols.txt`, and a +567-line `.editorconfig`; Issue #244 (2026-07-06) reported `Core logic changes: 0 files` while the actual changed-files enumeration **omitted the 3 changed C# files entirely** (not even mislabeled into the "Docs/templates/agents/tooling" bucket — they simply do not appear in any per-file `(+N/-M)` line in the summary, only in the appendix's raw diffstat), even though the two `.cs` files individually carried the largest line-count deltas (+212, +31) of any file in the diff; Issue #251 (2026-07-07) reported the same `Core logic changes: 0 files` / omission pattern for a 2-file (`QfcCollectionController.cs`, one new test file) diff; Issue #253 (2026-07-07) again reported `Core logic changes: 0 files` for a diff whose only production+test change was 2 `.cs` files, with the appendix's own "Files by extension" section (`2 .cs`) directly contradicting the summary's overview in the same artifact; Issue #270 (2026-07-07) reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 24 files" for a diff with 1 C# production file + 3 C# test files + 1 `.csproj` (the `.cs`/`.csproj` files omitted from the overview, listed only in the appendix). Issue #278 (2026-07-08) again reported `Core logic changes: 0 files` for a 2-file `.cs` diff (`PhysicalFileInfoAdapter.cs` + its test), with both files omitted from the overview entirely (they appear only inside quoted plan/evidence excerpts elsewhere in the summary, never as an overview bullet); corrected via a direct `Edit` adding a `Core logic changes: 2 files` block with `(+11/-3)`/`(+32/-18)` bullets sourced from `git diff --numstat -- '*.cs'`, labeled `CORRECTION (feature-review, <date>):` rather than the `[STALE-EVIDENCE CORRECTION]` tag used on #244 — either label works, what matters is that the corrected block uses the exact `- <path> (+N/-N)` bullet shape the hook's regex requires. Issue #283 (2026-07-08) is the same flat-omission variant but with a NON-ZERO `Core logic changes: 3 files` count (3 PowerShell `.ps1` files listed) while all 4 C# changes (`LiveOutlookHarnessRunner.cs` +139, its test +172, the modified integration test +66/-85, `TaskMaster.Test.csproj` +2) plus `.github/workflows/ci.yml` were omitted from the overview entirely — do NOT rely on the "0 files" symptom as the tell, since a non-zero count for one language can still hide a fully-omitted second language; corrected via an `Edit` rewriting the block to `Core logic changes: 8 files` with the `.cs`/`.csproj`/`.yml` bullets from `git diff --numstat`. Issue #208 (2026-07-09) again reported `Core logic changes: 0 files` for a bug fix whose diff had 5 C# files (new `TaskMaster/Logging/LogDirectoryInitializer.cs` +139, new test +201, `ThisAddIn.cs` +31, and two `.csproj` Compile-include lines); all 5 omitted from the overview and listed only in the docs/tooling bucket for the docs and in the appendix; corrected in place with a timestamped note plus a `Core logic changes: 5 files` bullet block using the exact `- <path> (+N/-N)` shape. Issue #292 (2026-07-09) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 19 files" for a bug fix whose diff had 3 C# production files (`StoresWrapper.cs` +22/-2, `CurrentStoreContext.cs` +9, `StoreLockupResponder.cs` +26) + 2 C# test files + 1 `.csproj`; all 6 omitted from the overview (only docs `.md` bullets appeared), corrected in place with a timestamped `CORRECTED BY FEATURE-REVIEW` note plus `Core logic changes (C#): 3 production files` and `Tests / project wiring (C#): 3 files` blocks using the exact `- <path> (+N/-N)` shape. Issue #328 (2026-07-15) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 20 files" for a full-feature store-exclusion change whose diff had 15 C# production files (`StoresWrapper.cs`, new `StoresWrapper.Filtering.cs`, `StoreFilterAttribution.cs`, `StoreWrapper.cs`, `StoreWrapperController.cs`, the viewer trio, 3 `ToDoModel` sites, 3 `TaskMaster` callers) + 8 C# test files + 4 `.csproj`; all `.cs` omitted from the overview (only 10 docs/evidence `.md`/`.xml` bullets appeared), corrected in place with a `CORRECTED BY feature-review` note plus a `Core logic changes (C# production): 15 files` block using the exact `- <path> (+N/-N)` shape — and note that the paths under `ToDoModel/Data Model/...` contain a SPACE, so those bullet lines are silently skipped by the hook's `^\s*-\s+(\S+)\s+\(\+\d+/-\d+\)\s*$` regex (the `\S+` path token cannot contain a space); listing the space-free `UtilitiesCS/OutlookObjects/Store/*.cs` bullets is what makes `Get-ChangedLanguageSet` enumerate CSharp. Issue #418 (2026-08-04) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 40 files" for a bug fix whose diff had 2 C# production files (`SVGControl/SvgRenderer.cs` +167/-24, new `SVGControl/SvgAssemblyProbe.cs` +67) + 3 new C# test files + 2 `.csproj` + `app.config` + `packages.config` + `TaskMaster.sln`; all 10 omitted from the overview (only 10 docs `.md` bullets appeared), corrected in place with a `NOTE (corrected by feature-review <ts>)` block plus a `Core logic changes: 10 files` bullet list. Two other collector defects co-occurred on #418 and are worth checking together: the summary falsely reported "GitHub CLI (gh) is not installed" (a PATH-resolution false negative; gh 2.87.3 was installed and on PATH), and its author-asserted auto-close list was polluted with `#419` (the merged package-update PR the branch rebased onto), `#AC-1`..`#AC-11` (acceptance-criteria labels lifted from commit messages), and `#DE06-4337` (a fragment of the new project GUID `{13AC39E6-DE06-4337-8EB0-41CE674A4C3B}` added to `TaskMaster.sln` — any `.sln` addition will produce this class of phantom issue reference). On the #418 **cycle-3 reaudit** (2026-08-05, head `69e675d0`) the regenerated summary reproduced the identical defect a third time on the same feature — `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 104 files" against a diff with 6 `.cs` + 2 `.csproj` + 2 `.config` + 1 `.sln` — so a regeneration at a new head does NOT fix it and the correction must be re-applied every cycle. The `#DE06-4337` GUID-fragment and `#AC-1..#AC-11` phantom close candidates recurred verbatim too. The misclassification is especially likely for C# build-config-only changes (csproj/packages.config/editorconfig) and, per #244/#251/#253/#283/#208/#292/#328, most often now manifests as flat omission (the summary's own docs-file count exactly matches the non-`.cs` file total, meaning the `.cs` files are dropped rather than relabeled) rather than mislabeling into a wrong bucket. Record it under `## Rejected Scope Narrowing` in the policy audit and proceed with the full diff scope regardless. Issue #424 (2026-08-06) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 36 files" for a bug fix whose diff had 6 C# production files + 8 C# test files + 2 `.csproj` (all space-free QuickFiler paths, all omitted from the overview; only docs/evidence `.md`/`.xml` bullets appeared); corrected in place with a bracketed correction note plus a `Core logic changes: 16 files` bullet list in the exact `- <path> (+N/-N)` shape. This is now a near-certain-per-review defect for any C#-touching feature — check for it every time without waiting for a symptom. Issue #230 (2026-08-07) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 30 files" for a full-feature diff with 2 C# production files + 7 test files + 1 `.csproj` (all space-free paths, all omitted from the overview — only the 10 largest docs/evidence `.md`/`.xml` bullets appeared); corrected in place by replacing the `Core logic changes: 0 files` line with a `Core logic changes: 10 files` annotated bullet block from `git diff --numstat`, after which the dot-sourced hook simulation enumerated `CSharp` and returned OK. Issue #503 (2026-08-08) again reported `Core logic changes: 0 files` / "Docs/templates/agents/tooling: 56 files" for a full-bug diff with 6 C# production files + 5 C# test files + 2 `.csproj` + 1 embedded `.xml` (all space-free `TaskMaster/Ribbon/...` and `TaskMaster.Test/Ribbon/...` paths, all omitted from the overview — only the 10 largest docs/evidence `.md` bullets appeared); corrected in place with a `CORRECTION (feature-review, <ts>)` block plus `Core logic changes: 16 files` bullets, after which the dot-sourced simulation enumerated `CSharp`.
 
 **Why:** The feature-review coverage validator (`validate-feature-review-coverage.ps1`) derives changed languages by parsing `- <path> (+N/-N)` lines in the summary. If `.cs` lines are missing/misclassified, the hook detects zero changed languages and trivially passes coverage validation — masking missing coverage for a language that actually changed.
 
diff --git a/.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md b/.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md
new file mode 100644
index 000000000..b656ba8ba
--- /dev/null
+++ b/.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md
@@ -0,0 +1,20 @@
+---
+name: two-vstest-binaries-binding-redirect
+description: TaskMaster has two vstest.console.exe binaries; the TestWindow one drops the app.config binding redirect and produces spurious Moq assembly-load failures. Use the TestPlatform one with /Settings:TaskMaster.runsettings.
+metadata:
+  type: project
+---
+
+Running a TaskMaster test assembly with `C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` and no `/Settings:` produces mass spurious failures: every test that touches Moq fails with `System.TypeInitializationException` for `Moq.Async.AwaitableFactory` wrapping `FileNotFoundException: Could not load file or assembly 'System.Threading.Tasks.Extensions, Version=4.2.0.1'`. The assembly IS present in the output directory and `app.config` DOES carry a `0.0.0.0-4.2.4.0 -> 4.2.4.0` redirect (on-disk package is 4.6.3); that host simply does not apply it.
+
+The correct invocation, which is what `scripts/vscode/Invoke-MSTestWithCoverage.ps1` resolves via `vswhere`, is:
+
+```
+& 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\Extensions\TestPlatform\vstest.console.exe' <assembly> /Settings:TaskMaster.runsettings [/TestCaseFilter:...]
+```
+
+On #503 the wrong host gave `Total tests: 69, Passed: 43, Failed: 26`; the right host gave `69/69, EXIT 0` on the identical binaries.
+
+**Why:** CLAUDE.md CUT3 prescribes only `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage` — it pins neither the binary nor the runsettings file, so a reviewer reaching for the first `vstest.console.exe` on disk will manufacture a 26-test "regression" that does not exist and may wrongly FAIL a green change.
+
+**How to apply:** Always use the `Extensions\TestPlatform` path plus `/Settings:TaskMaster.runsettings` when re-running tests during review. The tell that a failure set is a host artifact rather than a real regression: unrelated pre-existing tests in the same assembly fail with the identical assembly-load exception (on #503, three `FolderTree`/`FolderSnapshot` tests failed alongside the 23 feature tests). This is a different mechanism from [[vstest-argument-order-transitive-dep]] (#418), where ordinal position on the command line decided the outcome — check both before concluding a changed assembly is broken.
diff --git a/.claude/agent-memory/prd-feature/MEMORY.md b/.claude/agent-memory/prd-feature/MEMORY.md
index cf0f36ea8..d20dd3431 100644
--- a/.claude/agent-memory/prd-feature/MEMORY.md
+++ b/.claude/agent-memory/prd-feature/MEMORY.md
@@ -2,3 +2,4 @@
 - [Promotion scaffold metadata defects](project_promotion_scaffold_metadata_defects.md) — fix Status folder path and Last Updated date in scaffolded issue.md before filling docs
 - [Test disposition: grep for old-overload pins](feedback_test_disposition_overload_pins.md) — grep test project for Setup/Verify of retired overloads before marking any test file "unchanged"; loose mocks fail at run time
 - [AC gates: verify satisfiability + fresh reads](feedback_ac_gates_verify_satisfiability.md) — check baseline evidence before encoding repo-wide coverage floors as blocking AC; re-read spec from disk before reporting tallies
+- [full-bug means spec.md only](feedback_full_bug_spec_only.md) — never create user-story.md in full-bug mode; the agent's Expected Outputs header conflicts with the AC-tracking skill
diff --git a/.claude/agent-memory/prd-feature/feedback_full_bug_spec_only.md b/.claude/agent-memory/prd-feature/feedback_full_bug_spec_only.md
new file mode 100644
index 000000000..1f76d191d
--- /dev/null
+++ b/.claude/agent-memory/prd-feature/feedback_full_bug_spec_only.md
@@ -0,0 +1,12 @@
+---
+name: full-bug-spec-only
+description: In full-bug work mode author spec.md ONLY — do not create user-story.md, even though this agent's own Expected Outputs header lists it
+metadata:
+  type: feedback
+---
+
+When `issue.md` carries `- Work Mode: full-bug`, produce `spec.md` only and do not create `user-story.md`.
+
+**Why:** `.claude/skills/acceptance-criteria-tracking/SKILL.md` resolves the authoritative AC source by work mode: `full-bug` -> `spec.md` only; `full-feature` -> `spec.md` + `user-story.md`. The prd-feature agent's static "Expected Outputs" header unconditionally lists both files, so the header conflicts with the skill on every bug. Creating a second AC source in `full-bug` mode splits the acceptance criteria and breaks the executor/reviewer check-off protocol, which reads exactly one file.
+
+**How to apply:** Read the `- Work Mode:` marker in `issue.md` before writing anything. On `full-bug`, state in the spec header that it is the sole authoritative AC source and that no `user-story.md` exists, then report only `spec-path:` back to the caller. Related: [[ac-gates-verify-satisfiability]], [[promotion-scaffold-metadata-defects]].
diff --git a/.claude/agent-memory/task-researcher/MEMORY.md b/.claude/agent-memory/task-researcher/MEMORY.md
index ec0e356bd..7ada0c177 100644
--- a/.claude/agent-memory/task-researcher/MEMORY.md
+++ b/.claude/agent-memory/task-researcher/MEMORY.md
@@ -25,3 +25,4 @@
 - [efcviewer-breadcrumb-webview2-349](project_efcviewer_breadcrumb_webview2_349.md) — #349 (epic child 9102): EfcViewer3 dead; no JS<->.NET bridge precedent in repo; percent defect = unscaled ColumnHeader widths at high-DPI design scale (2026-07-16)
 - [svgcontrol-test-unwired-418](project_svgcontrol_test_unwired_418.md) — #418: SVGControl.Test absent from the .sln and its pinned test packages missing, so it cannot build; ExCSS 4.2.3-vs-4.3.1 redirect topology; Fizzler redirects inert (2026-08-04)
 - [winforms-pump-seam-230](project_winforms_pump_seam_230.md) — #230: WinFormsPumpHost design decided; CreateAsync factory-seam gap; InitializeWebViewAsync stays exempt; 19 -> 11 max (2026-08-07)
+- [ribbon-engine-readiness-503](project_ribbon_engine_readiness_503.md) — #503: whole TaskMaster Ribbon layer is coverage-excluded; net481 blocks default interface members; 5 orphan onAction callbacks in RibbonExplorer.xml (2026-08-08)
diff --git a/.claude/agent-memory/task-researcher/project_ribbon_engine_readiness_503.md b/.claude/agent-memory/task-researcher/project_ribbon_engine_readiness_503.md
new file mode 100644
index 000000000..fd46b0f41
--- /dev/null
+++ b/.claude/agent-memory/task-researcher/project_ribbon_engine_readiness_503.md
@@ -0,0 +1,25 @@
+---
+name: ribbon-engine-readiness-503
+description: "#503 ribbon engine-readiness research: whole TaskMaster Ribbon layer is [ExcludeFromCodeCoverage]; net481 blocks default interface members; 5 orphan onAction callbacks found in RibbonExplorer.xml"
+metadata:
+  type: project
+---
+
+Issue #503 (ribbon engine-readiness guard) research, 2026-08-08. Recommended design: readiness computed from the existing `IAppItemEngines.InboxEngines` member in new host-neutral `internal sealed` types under `TaskMaster\Ribbon\`, with **zero** change to `AppItemEngines.cs` / `IAppItemEngines.cs`.
+
+**Why:** Three non-obvious repo facts forced that choice, and each is expensive to rediscover.
+
+1. **The entire TaskMaster Ribbon layer is coverage-excluded.** `[ExcludeFromCodeCoverage]` sits on `RibbonController.cs:36` and `RibbonViewer.cs:32`, and `AppItemEngines.cs:26`. Because the attribute is type-level, it also silences `RibbonController.Intelligence.cs` and `RibbonController.FolderTree.cs` (same partial type) — so `RibbonControllerTests.cs` runs but contributes no covered lines. Any "put the logic on the controller" or "put it on AppItemEngines" proposal is uncoverable by construction.
+2. **net481 has no default interface members.** `TaskMaster.csproj` targets `v4.8.1` with `LangVersion=preview`; MS docs state DIM "require enhancements in the CLR … added in the CLR for .NET Core 3.0" (Roslyn CS8701). So a member added to `IAppItemEngines` can only be bodied on `AppItemEngines`, i.e. inside the excluded class. This is what kills the otherwise-clean `IsEngineReady(string)` interface option.
+3. **`IAppItemEngines` ripple is tiny, not large.** Exactly ONE implementer (`AppItemEngines`). The ~7 other hits are `IApplicationGlobals` doubles that merely expose an `IAppItemEngines Engines` property; the 4 `Mock<IAppItemEngines>` sites compile unchanged. So "ripple size" is NOT the reason to avoid the interface change — coverage is.
+
+**Coverable-seam precedent to copy:** `TaskMaster\AppGlobals\HookReadinessCoordinator.cs` and `EngineInitTimingProbe.cs` / `StartupDiagnosticsProbe.cs` each carry an explicit "intentionally NOT marked `[ExcludeFromCodeCoverage]`" remark and take `Action<string>` / interface delegates. Mirror that shape (and that doc-comment convention) for any new decision logic in TaskMaster.
+
+**Latent defects found in `RibbonExplorer.xml` (out of scope for #503, promote separately):**
+- Five `onAction` values with no matching `RibbonViewer` method: `BtnMigrateIDs_Click`, and a `_Clicked`-vs-`_Click` suffix mismatch on `MoveEntireConversation_Clicked`, `SaveAttachments_Clicked`, `SaveEmailCopy_Clicked`, `SavePictures_Clicked`. VSTO compiles fine and silently does nothing — all four Quick Filer settings check boxes are inert.
+- `SpamBayesEnabled_GetPressed` / `TriageEnabled_GetPressed` are `async Task<bool>`; the required signature is `bool GetPressed(IRibbonControl)`, so the pressed state is never applied.
+- A generalised "every ribbon callback resolves to a public RibbonViewer method with the documented signature" test in `RibbonExplorerXmlTests.cs` would catch this whole class, but it goes red on the five pre-existing orphans — ship it with the fix, not with an unrelated feature.
+
+**How to apply:** When any future TaskMaster ribbon/globals work asks "where do I put testable logic", assume the obvious host class is coverage-excluded and check for the attribute FIRST; then place logic in a new non-excluded `internal sealed` type and leave a one-method shim behind. See [[qfc-item-controller-227-r2-denial]] for why `[ExcludeFromCodeCoverage]` cannot substitute for a real seam, and [[feedback-promote-latent-defects-to-issues]] for the orphan-callback handling.
+
+Research artifact: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md`
diff --git a/TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs b/TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
new file mode 100644
index 000000000..96cd45300
--- /dev/null
+++ b/TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
@@ -0,0 +1,116 @@
+using System.Linq;
+using FluentAssertions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace TaskMaster.Test.Ribbon
+{
+    /// <summary>
+    /// Unit tests for the issue #503 control-id to engine-key catalog. The catalog is the single
+    /// source of truth shared by the ribbon XML, the <c>getEnabled</c> callback, the click guards,
+    /// and the post-initialization refresh, so these tests pin the exact mapping.
+    /// </summary>
+    [TestClass]
+    public class EngineCommandCatalogTests
+    {
+        [DataTestMethod]
+        [DataRow("TrainSpam", "Spam")]
+        [DataRow("TrainHam", "Spam")]
+        [DataRow("TestSpam", "Spam")]
+        [DataRow("TriageSetA", "Triage")]
+        [DataRow("TriageSetB", "Triage")]
+        [DataRow("TriageSetC", "Triage")]
+        [DataRow("ClearTriage", "Triage")]
+        [DataRow("FilterTriageGroup", "Triage")]
+        public void TryGetEngineName_ForEachEngineBackedControlId_ReturnsExpectedEngineName(
+            string controlId,
+            string expectedEngineName
+        )
+        {
+            // Act
+            var mapped = EngineCommandCatalog.TryGetEngineName(controlId, out var engineName);
+
+            // Assert
+            mapped.Should().BeTrue("'{0}' is an engine-backed control id", controlId);
+            engineName.Should().Be(expectedEngineName);
+        }
+
+        [TestMethod]
+        public void TryGetEngineName_ForUnknownControlId_ReturnsFalse()
+        {
+            // Act
+            var mapped = EngineCommandCatalog.TryGetEngineName(
+                "NotAnEngineBackedControl",
+                out var engineName
+            );
+
+            // Assert
+            mapped.Should().BeFalse("the catalog must not claim a control it does not own");
+            engineName.Should().BeNull();
+        }
+
+        [TestMethod]
+        public void TryGetEngineName_WithNullControlId_ReturnsFalse()
+        {
+            // Act: Office supplies control.Id, which the shim passes through unvalidated.
+            var mapped = EngineCommandCatalog.TryGetEngineName(null, out var engineName);
+
+            // Assert
+            mapped.Should().BeFalse("a null id must be rejected, not thrown on");
+            engineName.Should().BeNull();
+        }
+
+        [TestMethod]
+        public void TryGetEngineName_WithEmptyControlId_ReturnsFalse()
+        {
+            // Act
+            var mapped = EngineCommandCatalog.TryGetEngineName(string.Empty, out var engineName);
+
+            // Assert
+            mapped.Should().BeFalse("an empty id must be rejected, not thrown on");
+            engineName.Should().BeNull();
+        }
+
+        [TestMethod]
+        public void ControlIds_ContainsExactlyTheEightEngineBackedControlIds()
+        {
+            // Arrange
+            var expected = new[]
+            {
+                "TrainSpam",
+                "TrainHam",
+                "TestSpam",
+                "TriageSetA",
+                "TriageSetB",
+                "TriageSetC",
+                "ClearTriage",
+                "FilterTriageGroup",
+            };
+
+            // Act
+            var actual = EngineCommandCatalog.ControlIds;
+
+            // Assert: set equality, because callback ordering is unspecified in Office.
+            actual
+                .Should()
+                .BeEquivalentTo(
+                    expected,
+                    "the verified defect surface is exactly these eight controls"
+                );
+        }
+
+        [TestMethod]
+        public void ControlIds_ContainsNoDuplicates()
+        {
+            // Act
+            var controlIds = EngineCommandCatalog.ControlIds;
+
+            // Assert: a duplicate would cause a control to be invalidated twice on every refresh.
+            controlIds
+                .Should()
+                .HaveCount(
+                    controlIds.Distinct().Count(),
+                    "each engine-backed control id must appear exactly once"
+                );
+        }
+    }
+}
diff --git a/TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs b/TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
new file mode 100644
index 000000000..142deba46
--- /dev/null
+++ b/TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
@@ -0,0 +1,52 @@
+using System;
+using System.Collections.Generic;
+using FluentAssertions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace TaskMaster.Test.Ribbon
+{
+    /// <summary>
+    /// Unit tests for the issue #503 post-initialization refresh decision. Office caches each
+    /// <c>getEnabled</c> response per control until the add-in invalidates it, so the set of
+    /// invalidated control ids is what determines whether the eight engine-backed buttons become
+    /// enabled after <c>InitAsync()</c> succeeds.
+    /// </summary>
+    [TestClass]
+    public class EngineCommandRefreshPlannerTests
+    {
+        [TestMethod]
+        public void InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId()
+        {
+            // Arrange
+            var invalidated = new List<string>();
+
+            // Act
+            EngineCommandRefreshPlanner.InvalidateAll(invalidated.Add);
+
+            // Assert: SET equality, never an ordered sequence. Office documents callback ordering
+            // as unspecified, so no test may depend on invalidation order.
+            invalidated
+                .Should()
+                .BeEquivalentTo(
+                    EngineCommandCatalog.ControlIds,
+                    "every engine-backed control must be invalidated exactly once, and no other"
+                );
+            invalidated
+                .Should()
+                .HaveCount(
+                    EngineCommandCatalog.ControlIds.Count,
+                    "a control invalidated twice would signal a duplicate catalog entry"
+                );
+        }
+
+        [TestMethod]
+        public void InvalidateAll_WithNullDelegate_ThrowsArgumentNullException()
+        {
+            // Arrange, Act
+            Action act = () => EngineCommandRefreshPlanner.InvalidateAll(null);
+
+            // Assert
+            act.Should().Throw<ArgumentNullException>().WithParameterName("invalidateControl");
+        }
+    }
+}
diff --git a/TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs b/TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
new file mode 100644
index 000000000..a3ef771c9
--- /dev/null
+++ b/TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
@@ -0,0 +1,346 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using FluentAssertions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using UtilitiesCS;
+using UtilitiesCS.EmailIntelligence;
+
+namespace TaskMaster.Test.Ribbon
+{
+    /// <summary>
+    /// Regression tests for issue #503. Before the fix, an engine-backed Explorer-ribbon command
+    /// clicked before <c>AppItemEngines.InitAsync()</c> had populated
+    /// <c>Globals.Engines.InboxEngines</c> dereferenced an engine that did not yet exist and threw
+    /// out of an <c>async void</c> handler: <see cref="NullReferenceException"/> on the
+    /// <c>Controller.SB</c> / <c>Controller.Triage</c> paths and
+    /// <see cref="KeyNotFoundException"/> on the <c>TestSpam_Click</c> dictionary-indexer path.
+    /// </summary>
+    [TestClass]
+    public class EngineGatedCommandRunnerTests
+    {
+        /// <summary>
+        /// Builds an engines accessor over an <see cref="IAppItemEngines"/> whose
+        /// <c>InboxEngines</c> is the supplied dictionary, modelling the #503 window when that
+        /// dictionary is empty.
+        /// </summary>
+        private static Func<IAppItemEngines> CreateEnginesAccessor(
+            ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>> inboxEngines
+        )
+        {
+            var engines = new Mock<IAppItemEngines>();
+            engines.SetupGet(x => x.InboxEngines).Returns(inboxEngines);
+            return () => engines.Object;
+        }
+
+        /// <summary>
+        /// Builds a dictionary already carrying a non-null engine under the supplied key, modelling
+        /// state S2 (initialization complete, engine present).
+        /// </summary>
+        private static ConcurrentDictionary<
+            string,
+            IConditionalEngine<MailItemHelper>
+        > CreateReadyEngines(string engineName)
+        {
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[engineName] = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            return inboxEngines;
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException()
+        {
+            // Arrange: the #503 window — InboxEngines is the empty ConcurrentDictionary created by
+            // the AppItemEngines field initializer, so the "Spam" engine is absent.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var notifications = new List<string>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+            var invoked = false;
+
+            // Act: the action body reproduces the Controller.SB null-dereference shape.
+            Func<Task> act = () =>
+                runner.RunAsync(
+                    "TrainSpam",
+                    () =>
+                    {
+                        invoked = true;
+                        throw new NullReferenceException(
+                            "the guard must never let this action run while the engine is absent"
+                        );
+                    }
+                );
+
+            // Assert
+            await act.Should()
+                .NotThrowAsync(
+                    "a click during the initialization window must be a no-op, not an unhandled "
+                        + "NullReferenceException on the message-pump synchronization context"
+                );
+            invoked
+                .Should()
+                .BeFalse("the engine dereference must never be evaluated when the gate is closed");
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException()
+        {
+            // Arrange: same empty-dictionary window, exercised through the TestSpam_Click shape.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var notifications = new List<string>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+            var invoked = false;
+
+            // Act: the action body reproduces the TestSpam_Click dictionary-indexer shape,
+            // which throws KeyNotFoundException rather than NullReferenceException.
+            Func<Task> act = () =>
+                runner.RunAsync(
+                    "TestSpam",
+                    () =>
+                    {
+                        invoked = true;
+                        var engine = inboxEngines[SpamBayes.GroupName];
+                        return Task.FromResult(engine);
+                    }
+                );
+
+            // Assert
+            await act.Should()
+                .NotThrowAsync(
+                    "the indexer path in TestSpam_Click must also be suppressed during the "
+                        + "initialization window rather than throwing KeyNotFoundException"
+                );
+            invoked.Should().BeFalse("the indexer must never be evaluated when the gate is closed");
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName()
+        {
+            // Arrange
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var notifications = new List<string>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+
+            // Act
+            await runner.RunAsync("TriageSetA", () => Task.CompletedTask);
+
+            // Assert: exactly one "still loading" notice, naming both the control and its engine.
+            notifications
+                .Should()
+                .ContainSingle("a blocked click must produce one notification, never zero or many");
+            notifications[0].Should().Contain("TriageSetA").And.Contain("Triage");
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenEngineReady_InvokesActionExactlyOnce()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Spam")));
+            var notifications = new List<string>();
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+            var invocationCount = 0;
+
+            // Act
+            await runner.RunAsync(
+                "TrainSpam",
+                () =>
+                {
+                    invocationCount++;
+                    return Task.CompletedTask;
+                }
+            );
+
+            // Assert: the ready path is unchanged from pre-fix behaviour (R6).
+            invocationCount.Should().Be(1, "the ready path must run the action exactly once");
+            notifications.Should().BeEmpty("a ready command must not emit a still-loading notice");
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenEngineReady_AwaitsActionToCompletion()
+        {
+            // Arrange: a TaskCompletionSource the test completes synchronously, so completion is
+            // observed with no timing dependency and no sleep or delay of any kind.
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Triage")));
+            var notifications = new List<string>();
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+            var completionSource = new TaskCompletionSource<bool>();
+            var actionCompleted = false;
+
+            // Act
+            var runTask = runner.RunAsync(
+                "TriageSetB",
+                async () =>
+                {
+                    await completionSource.Task;
+                    actionCompleted = true;
+                }
+            );
+            runTask.IsCompleted.Should().BeFalse("the runner must still be awaiting the action");
+            completionSource.SetResult(true);
+            await runTask;
+
+            // Assert
+            actionCompleted
+                .Should()
+                .BeTrue(
+                    "RunAsync must await the supplied action to completion, not fire-and-forget"
+                );
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WhenActionThrows_PropagatesException()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Spam")));
+            var notifications = new List<string>();
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+
+            // Act
+            Func<Task> act = () =>
+                runner.RunAsync(
+                    "TrainHam",
+                    () => throw new InvalidOperationException("engine failure")
+                );
+
+            // Assert: the guard suppresses invocation, never errors. It must not swallow.
+            await act.Should()
+                .ThrowAsync<InvalidOperationException>(
+                    "an exception raised by a ready action must propagate unchanged (fail-fast)"
+                )
+                .WithMessage("engine failure");
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WithUnknownControlId_DoesNotInvokeAction()
+        {
+            // Arrange: engines are fully loaded, so only the unknown id can block the call.
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Spam")));
+            var notifications = new List<string>();
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+            var invoked = false;
+
+            // Act
+            await runner.RunAsync(
+                "NotAnEngineBackedControl",
+                () =>
+                {
+                    invoked = true;
+                    return Task.CompletedTask;
+                }
+            );
+
+            // Assert
+            invoked.Should().BeFalse("an id the catalog does not own must never run an action");
+            notifications.Should().ContainSingle();
+            notifications[0]
+                .Should()
+                .Contain("NotAnEngineBackedControl")
+                .And.Contain(
+                    "(unmapped)",
+                    "an unmapped id must be reported as such rather than named with a false engine"
+                );
+        }
+
+        [TestMethod]
+        public async Task RunAsync_WithNullAction_ThrowsArgumentNullException()
+        {
+            // Arrange
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var notifications = new List<string>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+            var runner = new EngineGatedCommandRunner(gate, notifications.Add);
+
+            // Act
+            Func<Task> act = () => runner.RunAsync("TrainSpam", null);
+
+            // Assert: the precondition is checked before any readiness evaluation, so no
+            // notification is emitted.
+            await act.Should().ThrowAsync<ArgumentNullException>().WithParameterName("action");
+            notifications
+                .Should()
+                .BeEmpty("the null-action precondition must be checked before the gate is queried");
+        }
+
+        [TestMethod]
+        public void IsCommandEnabled_WhenEngineNotReady_ReturnsFalse()
+        {
+            // Arrange: the #503 window.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+            var runner = new EngineGatedCommandRunner(gate, _ => { });
+
+            // Act
+            var enabled = runner.IsCommandEnabled("TrainSpam");
+
+            // Assert
+            enabled
+                .Should()
+                .BeFalse("Office must render the button disabled during initialization");
+        }
+
+        [TestMethod]
+        public void IsCommandEnabled_WhenEngineReady_ReturnsTrue()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Triage")));
+            var runner = new EngineGatedCommandRunner(gate, _ => { });
+
+            // Act
+            var enabled = runner.IsCommandEnabled("ClearTriage");
+
+            // Assert
+            enabled.Should().BeTrue("the button must become enabled once its engine has loaded");
+        }
+
+        [TestMethod]
+        public void IsCommandEnabled_WithUnknownControlId_ReturnsFalse()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(CreateReadyEngines("Spam")));
+            var runner = new EngineGatedCommandRunner(gate, _ => { });
+
+            // Act
+            var enabled = runner.IsCommandEnabled("NotAnEngineBackedControl");
+
+            // Assert
+            enabled
+                .Should()
+                .BeFalse("the callback must not claim ownership of a control it does not map");
+        }
+
+        [TestMethod]
+        public void Constructor_WithNullGate_ThrowsArgumentNullException()
+        {
+            // Arrange, Act
+            Action act = () => new EngineGatedCommandRunner(null, _ => { });
+
+            // Assert
+            act.Should().Throw<ArgumentNullException>().WithParameterName("gate");
+        }
+
+        [TestMethod]
+        public void Constructor_WithNullNotificationSink_ThrowsArgumentNullException()
+        {
+            // Arrange
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var gate = new EngineReadinessGate(CreateEnginesAccessor(inboxEngines));
+
+            // Act
+            Action act = () => new EngineGatedCommandRunner(gate, null);
+
+            // Assert
+            act.Should().Throw<ArgumentNullException>().WithParameterName("notifyNotReady");
+        }
+    }
+}
diff --git a/TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs b/TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
new file mode 100644
index 000000000..3edb5c4a8
--- /dev/null
+++ b/TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
@@ -0,0 +1,223 @@
+using System;
+using System.Collections.Concurrent;
+using FluentAssertions;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Moq;
+using UtilitiesCS;
+
+namespace TaskMaster.Test.Ribbon
+{
+    /// <summary>
+    /// Unit tests for the issue #503 per-engine-key readiness signal. The states exercised here
+    /// correspond to the spec state model S0 through S5: pre-init and init-in-flight (empty
+    /// dictionary), init complete with the engine present, init complete with the engine filtered
+    /// out by configuration, engine restarted, and a failed initialization.
+    /// </summary>
+    /// <remarks>
+    /// No test reaches the gate through <c>RibbonController.SB</c>, <c>Triage</c>, or
+    /// <c>TriageAsync</c>: those getters install a real <c>WindowsFormsSynchronizationContext</c>
+    /// on the calling thread as a side effect. The gate is exercised directly through its injected
+    /// <c>Func&lt;IAppItemEngines&gt;</c> accessor.
+    /// </remarks>
+    [TestClass]
+    public class EngineReadinessGateTests
+    {
+        private const string SpamEngineName = "Spam";
+
+        /// <summary>
+        /// Wraps the supplied dictionary in a mocked <see cref="IAppItemEngines"/> accessor.
+        /// </summary>
+        private static Func<IAppItemEngines> AccessorFor(
+            ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>> inboxEngines
+        )
+        {
+            var engines = new Mock<IAppItemEngines>();
+            engines.SetupGet(x => x.InboxEngines).Returns(inboxEngines);
+            return () => engines.Object;
+        }
+
+        [TestMethod]
+        public void IsEngineReady_WhenAccessorReturnsNull_ReturnsFalse()
+        {
+            // Arrange: models the window before RibbonController.SetGlobals has run, where
+            // `() => Globals?.Engines` yields null.
+            var gate = new EngineReadinessGate(() => null);
+
+            // Act
+            var ready = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            ready.Should().BeFalse("a null engines container must read as not ready, never throw");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_WhenInboxEnginesIsNull_ReturnsFalse()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(AccessorFor(null));
+
+            // Act
+            var ready = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            ready.Should().BeFalse("a null InboxEngines must read as not ready, never throw");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_WhenInboxEnginesIsEmpty_ReturnsFalse()
+        {
+            // Arrange: the #503 repro window — the field-initializer dictionary before
+            // InitAsync() assigns the populated one.
+            var gate = new EngineReadinessGate(
+                AccessorFor(new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>())
+            );
+
+            // Act
+            var ready = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            ready.Should().BeFalse("the engine is absent for the whole initialization window");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_WhenKeyPresentWithNonNullEngine_ReturnsTrue()
+        {
+            // Arrange
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[SpamEngineName] = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var ready = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            ready.Should().BeTrue("a present, non-null engine is the only ready state");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_WhenKeyPresentWithNullValue_ReturnsFalse()
+        {
+            // Arrange: a key whose value is null would still satisfy TryGetValue, so the null
+            // value must be rejected explicitly.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[SpamEngineName] = null;
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var ready = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            ready.Should().BeFalse("a present key with a null engine is not a ready state");
+        }
+
+        [DataTestMethod]
+        [DataRow(null)]
+        [DataRow("")]
+        [DataRow("   ")]
+        public void IsEngineReady_WithNullOrWhitespaceName_ReturnsFalse(string engineName)
+        {
+            // Arrange: engines are fully loaded, so only the name can make the probe fail.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[SpamEngineName] = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var ready = gate.IsEngineReady(engineName);
+
+            // Assert
+            ready
+                .Should()
+                .BeFalse("a null or whitespace engine name can never identify an engine");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_IsOrdinalCaseSensitive()
+        {
+            // Arrange: ConcurrentDictionary's default comparer is ordinal and case-sensitive.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[SpamEngineName] = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var exactCase = gate.IsEngineReady("Spam");
+            var lowerCase = gate.IsEngineReady("spam");
+
+            // Assert
+            exactCase.Should().BeTrue("\"Spam\" is the registered key");
+            lowerCase
+                .Should()
+                .BeFalse("\"spam\" is not \"Spam\" under the ordinal, case-sensitive default");
+        }
+
+        [TestMethod]
+        public void IsEngineReady_AfterDictionaryPopulated_ReturnsTrue()
+        {
+            // Arrange: the same dictionary instance is mutated between the two calls, modelling
+            // the S1 -> S2 transition and RestartEngineAsync with no timing dependency at all.
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var beforePopulation = gate.IsEngineReady(SpamEngineName);
+            inboxEngines[SpamEngineName] = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            var afterPopulation = gate.IsEngineReady(SpamEngineName);
+
+            // Assert
+            beforePopulation.Should().BeFalse("the engine had not been registered yet");
+            afterPopulation
+                .Should()
+                .BeTrue("readiness is recomputed on every query and is never cached in the gate");
+        }
+
+        [TestMethod]
+        public void TryGetEngine_WhenReady_OutputsSameInstance()
+        {
+            // Arrange
+            var expected = new Mock<IConditionalEngine<MailItemHelper>>().Object;
+            var inboxEngines =
+                new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>();
+            inboxEngines[SpamEngineName] = expected;
+            var gate = new EngineReadinessGate(AccessorFor(inboxEngines));
+
+            // Act
+            var resolved = gate.TryGetEngine(SpamEngineName, out var engine);
+
+            // Assert
+            resolved.Should().BeTrue();
+            engine
+                .Should()
+                .BeSameAs(expected, "the gate must hand back the registered instance, not a copy");
+        }
+
+        [TestMethod]
+        public void TryGetEngine_WhenNotReady_OutputsNull()
+        {
+            // Arrange
+            var gate = new EngineReadinessGate(
+                AccessorFor(new ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>())
+            );
+
+            // Act
+            var resolved = gate.TryGetEngine(SpamEngineName, out var engine);
+
+            // Assert
+            resolved.Should().BeFalse();
+            engine.Should().BeNull("a failed lookup must not leave a stale out value");
+        }
+
+        [TestMethod]
+        public void Constructor_WithNullAccessor_ThrowsArgumentNullException()
+        {
+            // Arrange, Act
+            Action act = () => new EngineReadinessGate(null);
+
+            // Assert: constructor-time invariant, per repository policy.
+            act.Should().Throw<ArgumentNullException>().WithParameterName("enginesAccessor");
+        }
+    }
+}
diff --git a/TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs b/TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
index 087f34bac..7d422ef39 100644
--- a/TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+++ b/TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Reflection;
 using System.Xml.Linq;
 using FluentAssertions;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
@@ -157,5 +158,161 @@ public void RibbonExplorerXml_TabMailCarriesNoCustomGroup()
                     "the built-in Mail tab must not host any custom TaskMaster group after the move"
                 );
         }
+
+        #region Issue #503 — engine-readiness getEnabled wiring
+
+        /// <summary>
+        /// The <c>getEnabled</c> callback name declared in the ribbon XML for every engine-backed
+        /// control. Office matches this string against a public instance method on
+        /// <see cref="RibbonViewer"/> by name.
+        /// </summary>
+        private const string EngineCommandGetEnabledCallback = "EngineCommand_GetEnabled";
+
+        /// <summary>
+        /// Every engine-backed control id in <c>EngineCommandCatalog</c> must exist in the ribbon
+        /// XML and must declare the <c>getEnabled</c> callback. Without the attribute the control
+        /// stays clickable for the whole initialization window, which is the #503 defect.
+        /// </summary>
+        [TestMethod]
+        public void RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback()
+        {
+            // Arrange
+            var document = LoadRibbonDocument();
+
+            // Act: index every element that carries an id.
+            var elementsById = document
+                .Descendants()
+                .Where(element => element.Attribute("id") != null)
+                .ToDictionary(element => element.Attribute("id")!.Value, element => element);
+
+            // Assert
+            foreach (var controlId in EngineCommandCatalog.ControlIds)
+            {
+                elementsById
+                    .Should()
+                    .ContainKey(
+                        controlId,
+                        "the catalog control id '{0}' must exist in the ribbon XML",
+                        controlId
+                    );
+                // Bind the attribute first. A null-conditional dereference here would
+                // short-circuit the whole assertion chain, including .Should(), so the
+                // test would pass silently on the exact regression it exists to catch.
+                var getEnabled = elementsById[controlId].Attribute("getEnabled");
+                getEnabled
+                    .Should()
+                    .NotBeNull(
+                        "control '{0}' is engine-backed and must declare a getEnabled callback",
+                        controlId
+                    );
+                getEnabled!
+                    .Value.Should()
+                    .Be(
+                        EngineCommandGetEnabledCallback,
+                        "control '{0}' is engine-backed and must be disabled until its engine loads",
+                        controlId
+                    );
+            }
+        }
+
+        /// <summary>
+        /// No element other than the engine-backed controls may declare the callback. Putting it
+        /// on a containing menu would disable save-location, folder-settings, and enable-toggle
+        /// commands that remain safe and useful during initialization.
+        /// </summary>
+        [TestMethod]
+        public void RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls()
+        {
+            // Arrange
+            var document = LoadRibbonDocument();
+
+            // Act
+            var declaringIds = document
+                .Descendants()
+                .Where(element =>
+                    element.Attribute("getEnabled")?.Value == EngineCommandGetEnabledCallback
+                )
+                .Select(element => element.Attribute("id")?.Value ?? "(no id)")
+                .ToList();
+
+            // Assert: set equality guards against over-disabling the UI.
+            declaringIds
+                .Should()
+                .BeEquivalentTo(
+                    EngineCommandCatalog.ControlIds,
+                    "only the engine-backed controls may be disabled by the readiness callback"
+                );
+        }
+
+        /// <summary>
+        /// The CustomUI schema exposes <c>getEnabled</c> on controls such as <c>button</c>, but
+        /// not on <c>group</c> or <c>tab</c>. A catalog id resolving to a container would make the
+        /// whole document illegal, which Outlook rejects all-or-nothing.
+        /// </summary>
+        [TestMethod]
+        public void RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled()
+        {
+            // Arrange
+            var document = LoadRibbonDocument();
+            var elementsById = document
+                .Descendants()
+                .Where(element => element.Attribute("id") != null)
+                .ToDictionary(element => element.Attribute("id")!.Value, element => element);
+
+            // Act, Assert
+            foreach (var controlId in EngineCommandCatalog.ControlIds)
+            {
+                elementsById[controlId]
+                    .Name.LocalName.Should()
+                    .Be(
+                        "button",
+                        "control '{0}' must be a button; group and tab do not permit getEnabled",
+                        controlId
+                    );
+            }
+        }
+
+        /// <summary>
+        /// VSTO silently ignores a callback whose signature does not match: the code compiles and
+        /// nothing happens when Office queries the control. This pins the exact required shape
+        /// <c>public bool GetEnabled(Office.IRibbonControl control)</c>.
+        /// </summary>
+        /// <remarks>
+        /// The parameter type is compared by <see cref="Type.FullName"/> rather than with
+        /// <c>typeof</c>: <c>TaskMaster.Test.csproj</c> carries no reference to the
+        /// <c>Office</c> (Microsoft.Office.Core) primary interop assembly, and a legacy non-SDK
+        /// <c>ProjectReference</c> does not flow that reference to the compiler. <c>office.dll</c>
+        /// is present in the test output directory and in the GAC, so the runtime reflection
+        /// resolves the type at test time.
+        /// </remarks>
+        [TestMethod]
+        public void RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer()
+        {
+            // Act
+            var callback = typeof(RibbonViewer).GetMethod(
+                EngineCommandGetEnabledCallback,
+                BindingFlags.Public | BindingFlags.Instance
+            );
+
+            // Assert
+            callback
+                .Should()
+                .NotBeNull(
+                    "'{0}' must be a public instance method on RibbonViewer",
+                    EngineCommandGetEnabledCallback
+                );
+            callback!.ReturnType.Should().Be<bool>("Office requires a bool getEnabled callback");
+
+            var parameters = callback.GetParameters();
+            parameters.Should().ContainSingle("the Office callback takes exactly one parameter");
+            parameters[0]
+                .ParameterType.FullName.Should()
+                .Be(
+                    "Microsoft.Office.Core.IRibbonControl",
+                    "the single parameter must be the Office IRibbonControl"
+                );
+        }
+
+        #endregion Issue #503 — engine-readiness getEnabled wiring
     }
 }
diff --git a/TaskMaster.Test/TaskMaster.Test.csproj b/TaskMaster.Test/TaskMaster.Test.csproj
index 6f5393f9c..c239693c5 100644
--- a/TaskMaster.Test/TaskMaster.Test.csproj
+++ b/TaskMaster.Test/TaskMaster.Test.csproj
@@ -308,6 +308,10 @@
     <Compile Include="AppGlobals\AppToDoObjectsTests.cs" />
     <Compile Include="OutlookObjects\Store\StoresWrapperEnumerationScopeTests.cs" />
     <Compile Include="OutlookObjects\Store\StoresWrapperTests.cs" />
+    <Compile Include="Ribbon\EngineCommandCatalogTests.cs" />
+    <Compile Include="Ribbon\EngineCommandRefreshPlannerTests.cs" />
+    <Compile Include="Ribbon\EngineGatedCommandRunnerTests.cs" />
+    <Compile Include="Ribbon\EngineReadinessGateTests.cs" />
     <Compile Include="Ribbon\RibbonControllerTests.cs" />
     <Compile Include="Ribbon\TryFunctionalityInConstructionTests.cs" />
     <Compile Include="Ribbon\RibbonExplorerXmlTests.cs" />
diff --git a/TaskMaster/Ribbon/EngineCommandCatalog.cs b/TaskMaster/Ribbon/EngineCommandCatalog.cs
new file mode 100644
index 000000000..2dc793c9b
--- /dev/null
+++ b/TaskMaster/Ribbon/EngineCommandCatalog.cs
@@ -0,0 +1,88 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// The single source of truth binding an Explorer-ribbon control id to the
+    /// <c>InboxEngines</c> key of the engine that backs it.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// This binding is shared by four consumers: the <c>getEnabled</c> attribute wiring in
+    /// <c>RibbonExplorer.xml</c>, the <c>EngineCommand_GetEnabled</c> callback, the click guards
+    /// in <see cref="EngineGatedCommandRunner"/>, and the post-initialization refresh planned by
+    /// <see cref="EngineCommandRefreshPlanner"/>. Centralizing it here is what allows a single
+    /// unit test to assert that the XML and the code agree.
+    /// </para>
+    /// <para>
+    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+    /// decision logic, contains no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+    /// unit-tested. It follows the <c>HookReadinessCoordinator</c> precedent.
+    /// </para>
+    /// <para>
+    /// The map is intentionally extensible: adding a future <c>Project</c>, <c>Context</c>, or
+    /// <c>Actionable</c> ribbon command is a single entry in <see cref="Map"/>.
+    /// </para>
+    /// </remarks>
+    internal static class EngineCommandCatalog
+    {
+        /// <summary>
+        /// Control id to engine key. Ordinal comparison, matching the
+        /// <see cref="System.Collections.Concurrent.ConcurrentDictionary{TKey, TValue}"/> default
+        /// used by <c>AppItemEngines.InboxEngines</c>.
+        /// </summary>
+        private static readonly IReadOnlyDictionary<string, string> Map = new Dictionary<
+            string,
+            string
+        >(StringComparer.Ordinal)
+        {
+            ["TrainSpam"] = "Spam",
+            ["TrainHam"] = "Spam",
+            ["TestSpam"] = "Spam",
+            ["TriageSetA"] = "Triage",
+            ["TriageSetB"] = "Triage",
+            ["TriageSetC"] = "Triage",
+            ["ClearTriage"] = "Triage",
+            ["FilterTriageGroup"] = "Triage",
+        };
+
+        private static readonly IReadOnlyCollection<string> ControlIdList =
+            new ReadOnlyCollection<string>(new List<string>(Map.Keys));
+
+        /// <summary>
+        /// The engine-backed Explorer-ribbon control ids, without duplicates.
+        /// </summary>
+        internal static IReadOnlyCollection<string> ControlIds => ControlIdList;
+
+        /// <summary>
+        /// Resolves the <c>InboxEngines</c> key that backs the supplied ribbon control id.
+        /// </summary>
+        /// <param name="controlId">
+        /// The ribbon control id, compared ordinally. May be null or empty.
+        /// </param>
+        /// <param name="engineName">
+        /// The engine key when the lookup succeeds; otherwise <see langword="null"/>.
+        /// </param>
+        /// <returns>
+        /// <see langword="true"/> when <paramref name="controlId"/> is an engine-backed control id;
+        /// <see langword="false"/> for a null, empty, or unrecognized id. A control this catalog
+        /// does not own must never be disabled by the readiness wiring, so the false result is the
+        /// safe default only in combination with the caller's own semantics.
+        /// </returns>
+        internal static bool TryGetEngineName(string controlId, out string engineName)
+        {
+            if (string.IsNullOrEmpty(controlId))
+            {
+                // null-forgiving: the pinned signature uses a non-nullable `out string`, and the
+                // documented contract is that callers must not read the out value when the method
+                // returns false. This keeps the file clean under /p:Nullable=enable.
+                engineName = null!;
+                return false;
+            }
+
+            return Map.TryGetValue(controlId, out engineName);
+        }
+    }
+}
diff --git a/TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs b/TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
new file mode 100644
index 000000000..0d5bff284
--- /dev/null
+++ b/TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
@@ -0,0 +1,58 @@
+using System;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// Decides which ribbon controls must be invalidated once engine initialization completes.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Office caches each <c>getEnabled</c> response per control until the add-in invalidates it,
+    /// so without an explicit invalidation the engine-backed buttons would remain disabled for the
+    /// whole session even after <c>InitAsync()</c> succeeds. This type owns the decision of
+    /// <em>which</em> controls to invalidate; the COM call itself
+    /// (<c>IRibbonUI.InvalidateControl</c>) stays behind the injected delegate in the
+    /// coverage-exempt ribbon shim.
+    /// </para>
+    /// <para>
+    /// The invalidation set is derived from <see cref="EngineCommandCatalog.ControlIds"/> rather
+    /// than duplicated as a literal list, so the catalog remains the single source of truth.
+    /// </para>
+    /// <para>
+    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+    /// unit-tested.
+    /// </para>
+    /// </remarks>
+    internal static class EngineCommandRefreshPlanner
+    {
+        /// <summary>
+        /// Requests invalidation of every engine-backed ribbon control exactly once.
+        /// </summary>
+        /// <param name="invalidateControl">
+        /// Invoked once per <see cref="EngineCommandCatalog.ControlIds"/> entry with that control
+        /// id. Must not be null.
+        /// </param>
+        /// <remarks>
+        /// Office documents callback ordering as unspecified, so no ordering guarantee is made or
+        /// required; only the set of invalidated ids is meaningful. The operation is idempotent —
+        /// invalidating an already-invalidated control is harmless — so a second refresh after
+        /// <c>RestartEngineAsync</c> is safe.
+        /// </remarks>
+        /// <exception cref="ArgumentNullException">
+        /// <paramref name="invalidateControl"/> is null.
+        /// </exception>
+        internal static void InvalidateAll(Action<string> invalidateControl)
+        {
+            if (invalidateControl is null)
+            {
+                throw new ArgumentNullException(nameof(invalidateControl));
+            }
+
+            foreach (var controlId in EngineCommandCatalog.ControlIds)
+            {
+                invalidateControl(controlId);
+            }
+        }
+    }
+}
diff --git a/TaskMaster/Ribbon/EngineGatedCommandRunner.cs b/TaskMaster/Ribbon/EngineGatedCommandRunner.cs
new file mode 100644
index 000000000..fae7444fb
--- /dev/null
+++ b/TaskMaster/Ribbon/EngineGatedCommandRunner.cs
@@ -0,0 +1,139 @@
+using System;
+using System.Globalization;
+using System.Threading.Tasks;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// The issue #503 click guard and the <c>getEnabled</c> decision for engine-backed
+    /// Explorer-ribbon commands.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Callers pass the engine-touching work as a <see cref="Func{Task}"/> lambda, so the engine
+    /// dereference is evaluated only inside the lambda body and never when the gate is closed.
+    /// That is what converts the pre-initialization <see cref="NullReferenceException"/> (the
+    /// <c>Controller.SB</c> / <c>Controller.Triage</c> paths) and
+    /// <see cref="System.Collections.Generic.KeyNotFoundException"/> (the <c>TestSpam_Click</c>
+    /// dictionary-indexer path) into a no-op, without scattering null-conditional operators
+    /// through <c>RibbonViewer</c>.
+    /// </para>
+    /// <para>
+    /// The guard suppresses <em>invocation</em>, never <em>errors</em>. When the gate is open and
+    /// the action throws, the exception propagates unchanged; this type contains no
+    /// <c>catch</c> clause of any kind, so it can never degenerate into a swallow-all.
+    /// </para>
+    /// <para>
+    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+    /// unit-tested. Presentation of the notification is the injected sink's concern and lives in
+    /// the coverage-exempt ribbon shim.
+    /// </para>
+    /// </remarks>
+    internal sealed class EngineGatedCommandRunner
+    {
+        /// <summary>
+        /// Rendered in place of a control id when the caller supplied null, so a notification is
+        /// never ambiguous about which id was seen.
+        /// </summary>
+        private const string NullControlIdToken = "(null)";
+
+        /// <summary>
+        /// Rendered in place of an engine key when the control id is not in
+        /// <see cref="EngineCommandCatalog"/>, so an unmapped id is distinguishable from a mapped
+        /// id whose engine has not loaded.
+        /// </summary>
+        private const string UnmappedEngineToken = "(unmapped)";
+
+        private readonly EngineReadinessGate _gate;
+        private readonly Action<string> _notifyNotReady;
+
+        /// <summary>
+        /// Creates a runner over a readiness gate and a notification sink.
+        /// </summary>
+        /// <param name="gate">The per-engine-key readiness signal; must not be null.</param>
+        /// <param name="notifyNotReady">
+        /// Receives exactly one message per blocked invocation. Must not be null. Presentation is
+        /// the sink's concern; this type decides only whether to notify and what the message says.
+        /// </param>
+        /// <exception cref="ArgumentNullException">Either argument is null.</exception>
+        internal EngineGatedCommandRunner(EngineReadinessGate gate, Action<string> notifyNotReady)
+        {
+            _gate = gate ?? throw new ArgumentNullException(nameof(gate));
+            _notifyNotReady =
+                notifyNotReady ?? throw new ArgumentNullException(nameof(notifyNotReady));
+        }
+
+        /// <summary>
+        /// The <c>getEnabled</c> decision for a ribbon control.
+        /// </summary>
+        /// <param name="controlId">The ribbon control id; ordinal comparison.</param>
+        /// <returns>
+        /// <see langword="true"/> only when the id is an engine-backed control id and its backing
+        /// engine is currently available. A null, empty, or unknown id yields
+        /// <see langword="false"/>.
+        /// </returns>
+        internal bool IsCommandEnabled(string controlId)
+        {
+            return EngineCommandCatalog.TryGetEngineName(controlId, out var engineName)
+                && _gate.IsEngineReady(engineName);
+        }
+
+        /// <summary>
+        /// Runs <paramref name="action"/> only when the command's backing engine is available.
+        /// </summary>
+        /// <param name="controlId">The ribbon control id that requested the work.</param>
+        /// <param name="action">
+        /// The engine-touching work, deferred into a lambda so it is not evaluated when the gate
+        /// is closed. Must not be null.
+        /// </param>
+        /// <returns>
+        /// A task that completes when the action completes, or an already-completed task when the
+        /// gate is closed.
+        /// </returns>
+        /// <exception cref="ArgumentNullException">
+        /// <paramref name="action"/> is null. Thrown before any readiness evaluation.
+        /// </exception>
+        internal Task RunAsync(string controlId, Func<Task> action)
+        {
+            if (action is null)
+            {
+                throw new ArgumentNullException(nameof(action));
+            }
+
+            if (!IsCommandEnabled(controlId))
+            {
+                _notifyNotReady(BuildNotReadyMessage(controlId));
+                return Task.CompletedTask;
+            }
+
+            return action();
+        }
+
+        /// <summary>
+        /// Builds the single "still loading" message emitted for a blocked invocation. The message
+        /// always carries the control id, and carries the engine key when the id is mapped.
+        /// </summary>
+        private static string BuildNotReadyMessage(string controlId)
+        {
+            // The lookup uses the rendered id so the argument is never null. A null control id
+            // renders as "(null)", which is not a catalog key, so it resolves to "(unmapped)" —
+            // exactly the same outcome as looking up null directly, without a nullable argument.
+            var renderedControlId = controlId ?? NullControlIdToken;
+            var engineName = EngineCommandCatalog.TryGetEngineName(
+                renderedControlId,
+                out var mapped
+            )
+                ? mapped
+                : UnmappedEngineToken;
+
+            return string.Format(
+                CultureInfo.CurrentCulture,
+                "The command '{0}' is still loading because its engine '{1}' is not available yet. "
+                    + "Please try again once initialization completes.",
+                renderedControlId,
+                engineName
+            );
+        }
+    }
+}
diff --git a/TaskMaster/Ribbon/EngineReadinessGate.cs b/TaskMaster/Ribbon/EngineReadinessGate.cs
new file mode 100644
index 000000000..f51579761
--- /dev/null
+++ b/TaskMaster/Ribbon/EngineReadinessGate.cs
@@ -0,0 +1,103 @@
+using System;
+using UtilitiesCS;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// The per-engine-key readiness signal for issue #503, computed live from the existing
+    /// <see cref="IAppItemEngines.InboxEngines"/> member.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <c>AppItemEngines.InboxEngines</c> is an empty <c>ConcurrentDictionary</c> from field-
+    /// initializer time until <c>InitAsync()</c> assigns the fully-built dictionary in a single
+    /// terminal reference assignment. A per-key probe is therefore precise and race-free: it never
+    /// observes a partially populated map.
+    /// </para>
+    /// <para>
+    /// Readiness is deliberately per-key rather than a coarse "initialization complete" flag.
+    /// <c>InitAsync()</c> filters on <c>config.Value.Engine</c> and drops null factory results, so
+    /// an engine that is configured off never enters the dictionary; a global flag would report
+    /// ready for a command that will never work. A per-key probe also handles
+    /// <c>RestartEngineAsync</c> re-assigning a single key, because nothing is cached here.
+    /// </para>
+    /// <para>
+    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+    /// unit-tested. It follows the <c>HookReadinessCoordinator</c> precedent.
+    /// </para>
+    /// </remarks>
+    internal sealed class EngineReadinessGate
+    {
+        private readonly Func<IAppItemEngines> _enginesAccessor;
+
+        /// <summary>
+        /// Creates a gate over an engines accessor.
+        /// </summary>
+        /// <param name="enginesAccessor">
+        /// Supplies the current engines container. Must not be null, but is expected to return
+        /// null before the ribbon controller has been given its globals, which the gate treats as
+        /// "not ready" rather than as an error.
+        /// </param>
+        /// <exception cref="ArgumentNullException">
+        /// <paramref name="enginesAccessor"/> is null.
+        /// </exception>
+        internal EngineReadinessGate(Func<IAppItemEngines> enginesAccessor)
+        {
+            _enginesAccessor =
+                enginesAccessor ?? throw new ArgumentNullException(nameof(enginesAccessor));
+        }
+
+        /// <summary>
+        /// Reports whether the engine registered under <paramref name="engineName"/> is available.
+        /// </summary>
+        /// <param name="engineName">
+        /// The <c>InboxEngines</c> key. Comparison is the <c>ConcurrentDictionary</c> default —
+        /// ordinal and case-sensitive — so <c>"spam"</c> is not <c>"Spam"</c>.
+        /// </param>
+        /// <returns>
+        /// <see langword="true"/> only when the accessor returns a non-null container, its
+        /// <c>InboxEngines</c> is non-null, the key is present, and the stored engine is non-null.
+        /// A null or whitespace <paramref name="engineName"/> yields <see langword="false"/>.
+        /// The result is recomputed on every call and is never cached.
+        /// </returns>
+        internal bool IsEngineReady(string engineName)
+        {
+            return TryGetEngine(engineName, out _);
+        }
+
+        /// <summary>
+        /// Resolves the engine registered under <paramref name="engineName"/>, applying the same
+        /// readiness predicate as <see cref="IsEngineReady"/>.
+        /// </summary>
+        /// <param name="engineName">The <c>InboxEngines</c> key; ordinal, case-sensitive.</param>
+        /// <param name="engine">
+        /// The registered engine when the gate is open; otherwise <see langword="null"/>.
+        /// </param>
+        /// <returns><see langword="true"/> when the engine is available.</returns>
+        internal bool TryGetEngine(string engineName, out IConditionalEngine<MailItemHelper> engine)
+        {
+            engine = null!;
+
+            if (string.IsNullOrWhiteSpace(engineName))
+            {
+                return false;
+            }
+
+            var engines = _enginesAccessor();
+            var inboxEngines = engines?.InboxEngines;
+            if (inboxEngines is null)
+            {
+                return false;
+            }
+
+            if (!inboxEngines.TryGetValue(engineName, out var candidate) || candidate is null)
+            {
+                return false;
+            }
+
+            engine = candidate;
+            return true;
+        }
+    }
+}
diff --git a/TaskMaster/Ribbon/RibbonController.EngineCommands.cs b/TaskMaster/Ribbon/RibbonController.EngineCommands.cs
new file mode 100644
index 000000000..d47209089
--- /dev/null
+++ b/TaskMaster/Ribbon/RibbonController.EngineCommands.cs
@@ -0,0 +1,100 @@
+using System;
+using System.Threading.Tasks;
+using System.Windows.Forms;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// Issue #503 engine-command wiring for <see cref="RibbonController"/>.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// This is thin COM/VSTO glue: every decision it makes is delegated to the host-neutral,
+    /// unit-tested <see cref="EngineGatedCommandRunner"/> / <see cref="EngineReadinessGate"/>
+    /// pair. The type-level <c>[ExcludeFromCodeCoverage]</c> declared on the
+    /// <c>RibbonController.cs</c> partial already applies to this file, so no second attribute is
+    /// declared here.
+    /// </para>
+    /// </remarks>
+    public partial class RibbonController
+    {
+        private EngineGatedCommandRunner _engineCommandRunner;
+
+        /// <summary>
+        /// The lazily-built gated runner for engine-backed ribbon commands.
+        /// </summary>
+        /// <remarks>
+        /// The readiness accessor is <c>() =&gt; Globals?.Engines</c>. The null-conditional is
+        /// load-bearing: ribbon callbacks are reachable before <c>SetGlobals</c> has run, and the
+        /// gate must report "not ready" rather than throw. The existing
+        /// <c>RibbonController.Engines</c> property is deliberately NOT used as the accessor
+        /// because it is not null-safe on <c>Globals</c>. The readiness decision is likewise never
+        /// routed through <c>SB</c> / <c>Triage</c> / <c>TriageAsync</c>, whose getters install a
+        /// real <c>WindowsFormsSynchronizationContext</c> on the calling thread as a side effect.
+        /// </remarks>
+        private EngineGatedCommandRunner EngineCommands =>
+            _engineCommandRunner ??= new EngineGatedCommandRunner(
+                // The null-forgiving operator records that this accessor may legitimately return
+                // null before SetGlobals has run. EngineReadinessGate treats a null result as
+                // "not ready" by contract, so null is a supported value rather than a defect.
+                new EngineReadinessGate(() => Globals?.Engines!),
+                NotifyEngineCommandNotReady
+            );
+
+        /// <summary>
+        /// The <c>getEnabled</c> decision for an engine-backed ribbon control.
+        /// </summary>
+        /// <param name="controlId">The ribbon control id.</param>
+        /// <returns>
+        /// <see langword="true"/> only when the control is engine-backed and its engine is loaded.
+        /// </returns>
+        internal bool IsEngineCommandEnabled(string controlId)
+        {
+            return EngineCommands.IsCommandEnabled(controlId);
+        }
+
+        /// <summary>
+        /// Runs an engine-backed ribbon command, suppressing invocation while its engine is
+        /// still loading.
+        /// </summary>
+        /// <param name="controlId">The ribbon control id that requested the work.</param>
+        /// <param name="action">
+        /// The engine-touching work, supplied as a lambda so the engine dereference is deferred
+        /// and never evaluated when the gate is closed.
+        /// </param>
+        /// <returns>A task that completes when the action completes, or immediately when the
+        /// gate is closed.</returns>
+        internal Task RunEngineCommandAsync(string controlId, Func<Task> action)
+        {
+            return EngineCommands.RunAsync(controlId, action);
+        }
+
+        /// <summary>
+        /// Asks the ribbon to re-query <c>getEnabled</c> for every engine-backed control.
+        /// </summary>
+        /// <remarks>
+        /// No-ops when the viewer has not been attached yet (<c>Ribbon_Load</c> has not run), so
+        /// an early refresh is harmless.
+        /// </remarks>
+        internal void RefreshEngineCommands()
+        {
+            _viewer?.InvalidateEngineCommands();
+        }
+
+        /// <summary>
+        /// Presents the single "still loading" notice emitted for a blocked engine command.
+        /// </summary>
+        /// <remarks>
+        /// Presentation only. The decision to notify and the message content are made by
+        /// <see cref="EngineGatedCommandRunner"/> and are unit-tested through its injected sink;
+        /// no test constructs a <see cref="MessageBox"/>. The repository has no non-modal notice
+        /// surface, so this uses the established <c>logger.Warn</c> plus
+        /// <c>MessageBox.Show</c> mechanism already used elsewhere in the ribbon layer.
+        /// </remarks>
+        private void NotifyEngineCommandNotReady(string message)
+        {
+            logger.Warn(message);
+            MessageBox.Show(message);
+        }
+    }
+}
diff --git a/TaskMaster/Ribbon/RibbonExplorer.xml b/TaskMaster/Ribbon/RibbonExplorer.xml
index dcc043a73..9d8403ee3 100644
--- a/TaskMaster/Ribbon/RibbonExplorer.xml
+++ b/TaskMaster/Ribbon/RibbonExplorer.xml
@@ -100,12 +100,14 @@
             id="TrainSpam"
             imageMso="CancelAll"
             onAction="TrainSpam_Click"
+            getEnabled="EngineCommand_GetEnabled"
             label="Train Spam"
           />
           <button
             id="TrainHam"
             imageMso="ClickToRunEnableUpdates"
             onAction="TrainHam_Click"
+            getEnabled="EngineCommand_GetEnabled"
             label="Train Ham"
           />
           <menu id="OtherSpamActions" imageMso="AdministrationHome" label="Other" size="normal">
@@ -151,6 +153,7 @@
               id="TestSpam"
               imageMso="CalculateNow"
               onAction="TestSpam_Click"
+              getEnabled="EngineCommand_GetEnabled"
               label="Test Spam"
             />
             <button
@@ -442,20 +445,37 @@
           </menu>
         </group>
         <group id="TriageGroup" imageMso="Filter" label="Triage">
-          <button id="TriageSetA" onAction="TriageSetA_Click" label="Set A" />
-          <button id="TriageSetB" onAction="TriageSetB_Click" label="Set B" />
-          <button id="TriageSetC" onAction="TriageSetC_Click" label="Set C" />
+          <button
+            id="TriageSetA"
+            onAction="TriageSetA_Click"
+            getEnabled="EngineCommand_GetEnabled"
+            label="Set A"
+          />
+          <button
+            id="TriageSetB"
+            onAction="TriageSetB_Click"
+            getEnabled="EngineCommand_GetEnabled"
+            label="Set B"
+          />
+          <button
+            id="TriageSetC"
+            onAction="TriageSetC_Click"
+            getEnabled="EngineCommand_GetEnabled"
+            label="Set C"
+          />
           <menu id="OtherTriageActions" label="Other" size="normal">
             <button
               id="FilterTriageGroup"
               imageMso="Filter"
               onAction="FilterViewer_Click"
+              getEnabled="EngineCommand_GetEnabled"
               label="Filter"
             />
             <button
               id="ClearTriage"
               imageMso="Clear"
               onAction="ClearTriage_Click"
+              getEnabled="EngineCommand_GetEnabled"
               label="Clear Triage Field"
             />
             <button
diff --git a/TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs b/TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
new file mode 100644
index 000000000..6c0cd9b97
--- /dev/null
+++ b/TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
@@ -0,0 +1,207 @@
+using System.Threading.Tasks;
+using UtilitiesCS;
+using UtilitiesCS.EmailIntelligence;
+using Office = Microsoft.Office.Core;
+
+namespace TaskMaster
+{
+    /// <summary>
+    /// Issue #503 engine-command wiring for <see cref="RibbonViewer"/>.
+    /// </summary>
+    /// <remarks>
+    /// Thin COM/VSTO glue only. The <c>[ComVisible(true)]</c> and <c>[ExcludeFromCodeCoverage]</c>
+    /// attributes declared on the <c>RibbonViewer.cs</c> partial already apply to the whole type,
+    /// so neither is repeated here and no new COM-visible type is introduced.
+    /// </remarks>
+    public partial class RibbonViewer
+    {
+        /// <summary>
+        /// The Office <c>getEnabled</c> callback shared by all eight engine-backed controls.
+        /// </summary>
+        /// <param name="control">The control Office is querying.</param>
+        /// <returns>
+        /// <see langword="true"/> only when the control is engine-backed and its engine is loaded;
+        /// <see langword="false"/> when the controller or the control is null, so a control this
+        /// callback does not own is never disabled by it.
+        /// </returns>
+        /// <remarks>
+        /// The signature is fixed by Office: a <c>public</c> instance method returning
+        /// <see cref="bool"/> with a single <c>Office.IRibbonControl</c> parameter. VSTO silently
+        /// ignores a signature mismatch — the code compiles and nothing happens — which is why
+        /// <c>RibbonExplorerXmlTests</c> pins this signature by reflection.
+        /// </remarks>
+        /// <remarks>
+        /// The null-forgiving operator on <c>control?.Id</c> records that a null id is a supported
+        /// input: <c>EngineCommandCatalog.TryGetEngineName</c> returns <see langword="false"/> for
+        /// it by contract, so the callback yields <see langword="false"/> rather than throwing.
+        /// </remarks>
+        public bool EngineCommand_GetEnabled(Office.IRibbonControl control) =>
+            _controller?.IsEngineCommandEnabled(control?.Id!) ?? false;
+
+        /// <summary>
+        /// Invalidates every engine-backed control so Office re-queries
+        /// <see cref="EngineCommand_GetEnabled"/> after engine initialization completes.
+        /// </summary>
+        /// <remarks>
+        /// <para>
+        /// Office caches each <c>getEnabled</c> response per control until the add-in invalidates
+        /// it, so this call is load-bearing: without it the eight buttons stay disabled for the
+        /// whole session even after <c>InitAsync()</c> succeeds.
+        /// </para>
+        /// <para>
+        /// <c>IRibbonUI</c> is an Office COM object handed to <c>Ribbon_Load</c> on the STA and
+        /// must be called back on the STA. The marshalling is therefore explicit through
+        /// <c>UtilitiesCS.UiThread.Dispatcher</c> (declared in <c>UtilitiesCS\Threading\UiThread.cs</c>,
+        /// namespace <c>UtilitiesCS</c>) rather than left to the ambient synchronization context:
+        /// <c>InitAsync()</c> is launched via <c>Task.Run</c> and only resumes on the STA when a
+        /// synchronization context happened to be captured, which is not true on every load path.
+        /// </para>
+        /// <para>
+        /// Returns without throwing when the ribbon has not been loaded yet.
+        /// </para>
+        /// </remarks>
+        internal void InvalidateEngineCommands()
+        {
+            var ribbon = _ribbon;
+            if (ribbon is null)
+            {
+                return;
+            }
+
+            var dispatcher = UiThread.Dispatcher;
+            if (dispatcher != null && !dispatcher.CheckAccess())
+            {
+                dispatcher.Invoke(() =>
+                    EngineCommandRefreshPlanner.InvalidateAll(ribbon.InvalidateControl)
+                );
+                return;
+            }
+
+            EngineCommandRefreshPlanner.InvalidateAll(ribbon.InvalidateControl);
+        }
+
+        #region Spam Manager
+
+        public async void ClearSpam_Click(Office.IRibbonControl control) =>
+            await Controller.ClearSpamManagerAsync();
+
+        public async void TrainSpam_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TrainSpam",
+                () => Controller.SB.TrainAsync(Controller.OlSelection, true)
+            );
+
+        public async void TrainHam_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TrainHam",
+                () => Controller.SB.TrainAsync(Controller.OlSelection, false)
+            );
+
+        public async void TestSpam_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TestSpam",
+                () =>
+                    (
+                        (SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine
+                    ).TestAsync(Controller.OlSelection)
+            );
+
+        public void TestSpamVerbose_Click(Office.IRibbonControl control) =>
+            Controller.TestSpamVerbose();
+
+        public void SpamMetrics_Click(Office.IRibbonControl control) => Controller.SpamMetrics();
+
+        public void SpamInvestigateErrors_Click(Office.IRibbonControl control) =>
+            Controller.SpamInvestigateErrors();
+
+        #region Spam Config
+
+        public void SpamBayesEnabled_Click(Office.IRibbonControl control, bool pressed) =>
+            Controller.Engines.ToggleEngineAsync(SpamBayes.GroupName);
+
+        public async Task<bool> SpamBayesEnabled_GetPressed(Office.IRibbonControl control) =>
+            await Controller.Engines.EngineActiveAsync(SpamBayes.GroupName);
+
+        public async void SpamSaveNetwork_Click(Office.IRibbonControl control) =>
+            await Controller.Engines.ShowDiskDialog(SpamBayes.GroupName, false);
+
+        public async void SpamSaveLocal_Click(Office.IRibbonControl control) =>
+            await Controller.Engines.ShowDiskDialog(SpamBayes.GroupName, true);
+
+        public void GetSaveLocation_Click(Office.IRibbonControl control) =>
+            Controller.Engines.ShowSaveInfo(SpamBayes.GroupName);
+
+        public void SpamFolderSettings_Click(Office.IRibbonControl control) =>
+            Controller.FolderStoresSettings();
+
+        #endregion Spam Config
+
+        #endregion Spam Manager
+
+        #region Triage
+
+        public async void TriageSelection_Click(Office.IRibbonControl control) =>
+            await _controller.TriageSelectionAsync();
+
+        public async void TriageSetA_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TriageSetA",
+                () => _controller.Triage.OlLogic.TrainSelectionAsync("A")
+            );
+
+        public async void TriageSetB_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TriageSetB",
+                () => _controller.Triage.OlLogic.TrainSelectionAsync("B")
+            );
+
+        public async void TriageSetC_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "TriageSetC",
+                () => _controller.Triage.OlLogic.TrainSelectionAsync("C")
+            );
+
+        //public async void TriageSetA_Click(Office.IRibbonControl control) => await _controller.TriageSetAAsync();
+        //public async void TriageSetB_Click(Office.IRibbonControl control) => await _controller.TriageSetBAsync();
+        //public async void TriageSetC_Click(Office.IRibbonControl control) => await _controller.TriageSetCAsync();
+
+        public async void ClearTriage_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "ClearTriage",
+                () => _controller.Triage.OlLogic.UnTrainSelectionAsync()
+            );
+
+        public async void ResetTriage_Click(Office.IRibbonControl control) =>
+            await _controller.ResetTriageClassifierAync();
+
+        public async void SetPrecision_Click(Office.IRibbonControl control) =>
+            await _controller.TriageSetPrecision();
+
+        public async void FilterViewer_Click(Office.IRibbonControl control) =>
+            await Controller.RunEngineCommandAsync(
+                "FilterTriageGroup",
+                () => _controller.Triage.OlLogic.FilterViewAsync()
+            );
+
+        #region Triage Config
+
+        public void TriageEnabled_Click(Office.IRibbonControl control, bool pressed) =>
+            Controller.Engines.ToggleEngineAsync("Triage");
+
+        public async Task<bool> TriageEnabled_GetPressed(Office.IRibbonControl control) =>
+            await Controller.Engines.EngineActiveAsync("Triage");
+
+        public async void TriageSaveNetwork_Click(Office.IRibbonControl control) =>
+            await Controller.Engines.ShowDiskDialog("Triage", false);
+
+        public async void TriageSaveLocal_Click(Office.IRibbonControl control) =>
+            await Controller.Engines.ShowDiskDialog("Triage", true);
+
+        public void TriageGetSaveLocation_Click(Office.IRibbonControl control) =>
+            Controller.Engines.ShowSaveInfo("Triage");
+
+        #endregion Triage Config
+
+        #endregion Triage
+    }
+}
diff --git a/TaskMaster/Ribbon/RibbonViewer.cs b/TaskMaster/Ribbon/RibbonViewer.cs
index 9ddc56dec..9ec5ba90d 100644
--- a/TaskMaster/Ribbon/RibbonViewer.cs
+++ b/TaskMaster/Ribbon/RibbonViewer.cs
@@ -30,7 +30,7 @@ namespace TaskMaster
 
     [System.Runtime.InteropServices.ComVisible(true)]
     [ExcludeFromCodeCoverage]
-    public class RibbonViewer : Office.IRibbonExtensibility
+    public partial class RibbonViewer : Office.IRibbonExtensibility
     {
         public RibbonViewer(RibbonController Controller)
         {
@@ -247,105 +247,6 @@ public async void BuildActionableClassifier_Click(Office.IRibbonControl control)
 
         #endregion Folder Classifier
 
-        #region Spam Manager
-
-        public async void ClearSpam_Click(Office.IRibbonControl control) =>
-            await Controller.ClearSpamManagerAsync();
-
-        public async void TrainSpam_Click(Office.IRibbonControl control) =>
-            await Controller.SB.TrainAsync(Controller.OlSelection, true);
-
-        public async void TrainHam_Click(Office.IRibbonControl control) =>
-            await Controller.SB.TrainAsync(Controller.OlSelection, false);
-
-        public async void TestSpam_Click(Office.IRibbonControl control) =>
-            await (
-                (SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine
-            ).TestAsync(Controller.OlSelection);
-
-        public void TestSpamVerbose_Click(Office.IRibbonControl control) =>
-            Controller.TestSpamVerbose();
-
-        public void SpamMetrics_Click(Office.IRibbonControl control) => Controller.SpamMetrics();
-
-        public void SpamInvestigateErrors_Click(Office.IRibbonControl control) =>
-            Controller.SpamInvestigateErrors();
-
-        #region Spam Config
-
-        public void SpamBayesEnabled_Click(Office.IRibbonControl control, bool pressed) =>
-            Controller.Engines.ToggleEngineAsync(SpamBayes.GroupName);
-
-        public async Task<bool> SpamBayesEnabled_GetPressed(Office.IRibbonControl control) =>
-            await Controller.Engines.EngineActiveAsync(SpamBayes.GroupName);
-
-        public async void SpamSaveNetwork_Click(Office.IRibbonControl control) =>
-            await Controller.Engines.ShowDiskDialog(SpamBayes.GroupName, false);
-
-        public async void SpamSaveLocal_Click(Office.IRibbonControl control) =>
-            await Controller.Engines.ShowDiskDialog(SpamBayes.GroupName, true);
-
-        public void GetSaveLocation_Click(Office.IRibbonControl control) =>
-            Controller.Engines.ShowSaveInfo(SpamBayes.GroupName);
-
-        public void SpamFolderSettings_Click(Office.IRibbonControl control) =>
-            Controller.FolderStoresSettings();
-
-        #endregion Spam Config
-
-        #endregion Spam Manager
-
-        #region Triage
-
-        public async void TriageSelection_Click(Office.IRibbonControl control) =>
-            await _controller.TriageSelectionAsync();
-
-        public async void TriageSetA_Click(Office.IRibbonControl control) =>
-            await _controller.Triage.OlLogic.TrainSelectionAsync("A");
-
-        public async void TriageSetB_Click(Office.IRibbonControl control) =>
-            await _controller.Triage.OlLogic.TrainSelectionAsync("B");
-
-        public async void TriageSetC_Click(Office.IRibbonControl control) =>
-            await _controller.Triage.OlLogic.TrainSelectionAsync("C");
-
-        //public async void TriageSetA_Click(Office.IRibbonControl control) => await _controller.TriageSetAAsync();
-        //public async void TriageSetB_Click(Office.IRibbonControl control) => await _controller.TriageSetBAsync();
-        //public async void TriageSetC_Click(Office.IRibbonControl control) => await _controller.TriageSetCAsync();
-
-        public async void ClearTriage_Click(Office.IRibbonControl control) =>
-            await _controller.Triage.OlLogic.UnTrainSelectionAsync();
-
-        public async void ResetTriage_Click(Office.IRibbonControl control) =>
-            await _controller.ResetTriageClassifierAync();
-
-        public async void SetPrecision_Click(Office.IRibbonControl control) =>
-            await _controller.TriageSetPrecision();
-
-        public async void FilterViewer_Click(Office.IRibbonControl control) =>
-            await _controller.Triage.OlLogic.FilterViewAsync();
-
-        #region Triage Config
-
-        public void TriageEnabled_Click(Office.IRibbonControl control, bool pressed) =>
-            Controller.Engines.ToggleEngineAsync("Triage");
-
-        public async Task<bool> TriageEnabled_GetPressed(Office.IRibbonControl control) =>
-            await Controller.Engines.EngineActiveAsync("Triage");
-
-        public async void TriageSaveNetwork_Click(Office.IRibbonControl control) =>
-            await Controller.Engines.ShowDiskDialog("Triage", false);
-
-        public async void TriageSaveLocal_Click(Office.IRibbonControl control) =>
-            await Controller.Engines.ShowDiskDialog("Triage", true);
-
-        public void TriageGetSaveLocation_Click(Office.IRibbonControl control) =>
-            Controller.Engines.ShowSaveInfo("Triage");
-
-        #endregion Triage Config
-
-        #endregion Triage
-
         public async void CompareFolders_Click(Office.IRibbonControl control) =>
             await _controller.CompareFoldersAsync();
 
diff --git a/TaskMaster/TaskMaster.csproj b/TaskMaster/TaskMaster.csproj
index c1ab66e34..f0c5c3af4 100644
--- a/TaskMaster/TaskMaster.csproj
+++ b/TaskMaster/TaskMaster.csproj
@@ -456,10 +456,16 @@
       <DependentUpon>Settings.settings</DependentUpon>
       <DesignTimeSharedInput>True</DesignTimeSharedInput>
     </Compile>
+    <Compile Include="Ribbon\EngineCommandCatalog.cs" />
+    <Compile Include="Ribbon\EngineCommandRefreshPlanner.cs" />
+    <Compile Include="Ribbon\EngineGatedCommandRunner.cs" />
+    <Compile Include="Ribbon\EngineReadinessGate.cs" />
     <Compile Include="Ribbon\RibbonController.cs" />
+    <Compile Include="Ribbon\RibbonController.EngineCommands.cs" />
     <Compile Include="Ribbon\RibbonController.FolderTree.cs" />
     <Compile Include="Ribbon\RibbonController.Intelligence.cs" />
     <Compile Include="Ribbon\RibbonViewer.cs" />
+    <Compile Include="Ribbon\RibbonViewer.EngineCommands.cs" />
     <Compile Include="Ribbon\TryFunctionalityInConstruction.cs" />
     <Compile Include="ThisAddIn.cs">
       <SubType>Code</SubType>
diff --git a/TaskMaster/ThisAddIn.cs b/TaskMaster/ThisAddIn.cs
index 5e8cfcd14..748e559b2 100644
--- a/TaskMaster/ThisAddIn.cs
+++ b/TaskMaster/ThisAddIn.cs
@@ -74,6 +74,13 @@ private void Application_Startup()
                 {
                     _currentStartupStageLabel = StartupStageLabels.Loading;
                     await _globals.LoadAsync(false);
+
+                    // Issue #503: this refresh is load-bearing, not cosmetic. Office caches each
+                    // getEnabled response per control until the add-in invalidates it, so without
+                    // this call the eight engine-backed buttons remain disabled for the whole
+                    // session even after AppItemEngines.InitAsync() has succeeded.
+                    _ribbonController.RefreshEngineCommands();
+
                     logger.Debug("Finished loading globals");
                     _currentStartupStageLabel = StartupStageLabels.PostLoad;
                     _startupPostLoadReached = true;
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md
new file mode 100644
index 000000000..302c5c288
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md
@@ -0,0 +1,53 @@
+# Code Review — ribbon-engine-readiness-guard (Issue #503)
+
+- Feature folder: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`
+- Base branch: `main` @ `003c5715055d7d1933db68a742531332756e30b2`
+- Head: `bug/ribbon-engine-readiness-guard-503` @ `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c`
+- Scope: full branch diff against the merge-base — 16 C#/project/resource paths plus documentation, evidence, and agent-memory files
+- Reviewed: 2026-08-08T14-15
+
+## Executive Summary
+
+The design is the right one for this defect and for this codebase. The central insight — that readiness must be evaluated per engine key rather than as a global "initialization complete" flag — is correct and well argued: `AppItemEngines.InitAsync()` filters engines on `config.Value.Engine` and drops null factory results, so a coarse flag would report ready for a command that will never work, converting a timing bug into a permanent one. The second key decision, deferring the engine dereference into a `Func<Task>` lambda rather than scattering null-conditional operators through eight handlers, is what makes the guard a single auditable chokepoint instead of eight independent partial fixes.
+
+The separation between decision and presentation is disciplined. All four new types are host-neutral, carry zero `Microsoft.Office.*` reference, take their collaborators as plain delegates, and are deliberately left out of the coverage exemption. Everything that touches COM stays inside types that were already exempt at the merge-base. This is the distinction the repository's own #227 precedent asks for, and it is applied here without the usual slippage of pushing one more decision into the exempt shim.
+
+Error handling is correct in the way that matters most for a guard: the runner contains no `catch` clause of any kind, so it can never degenerate into a swallow-all. `RunAsync` validates its action argument before touching the gate, so a programming error surfaces immediately rather than being masked by a closed gate. The ready path returns `action()` directly, which preserves the caller's await semantics and keeps behaviour byte-identical to the pre-fix handlers.
+
+Test quality is high. Each of the 45 added tests names a behaviour, follows Arrange–Act–Assert explicitly, and supplies a `because` reason on every assertion. The regression tests deliberately reproduce both reported exception shapes, and the S1-to-S2 transition is modelled by mutating a dictionary between two probes rather than by any timing construct.
+
+Seven findings are recorded. None is blocking. The most substantive is a null-conditional operator in the ribbon-XML test that makes the assertion named by AC5 silently vacuous when the attribute is absent; the acceptance criterion is nevertheless genuinely enforced, because a sibling test asserts set equality over the declaring ids. The remainder are a narrow residual dereference window the readiness contract does not cover, a non-thread-safe lazy initialiser, and four documentation or process observations.
+
+## Findings Table
+
+| Severity | File | Location | Finding | Recommendation | Rationale | Evidence |
+|---|---|---|---|---|---|---|
+| Medium | `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | lines 197-206, `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` | The assertion is written `elementsById[controlId].Attribute("getEnabled")?.Value.Should().Be(...)`. The null-conditional operator short-circuits the entire chain, so when the `getEnabled` attribute is absent the assertion does not execute and the test passes silently. This is precisely the failure mode the test exists to catch. | Remove the `?.` and assert on the attribute itself first, for example `var attribute = elementsById[controlId].Attribute("getEnabled"); attribute.Should().NotBeNull(...); attribute!.Value.Should().Be(...)`. | A regression test that cannot fail on its own stated condition provides no protection. The criterion it is named against (AC5) is the primary XML-wiring guarantee. | Verified by source inspection of lines 197-206; contrast with line 224 in the sibling test, which correctly uses `?.Value ==` inside a predicate where null-means-no-match is the intended semantics. |
+| Medium | `TaskMaster/Ribbon/RibbonExplorer.xml` | lines 445-466 | The file moved from 519 to 539 lines while already above the repository 500-line limit. Only 8 of the 23 added lines are functionally required; the three `TriageSet*` buttons were expanded from one line each to six lines each, adding 12 avoidable lines. | Either add the attribute inline on the three single-line buttons, or accept the reformatting and pair it with a follow-up issue to split the resource. Do not silently grow an already-oversized file. | `spec.md` AC25 accepts the 519-line overage as pre-existing, but it quotes 519 as the figure being accepted; growing the file by a further 20 lines was not the accepted position, and 12 of those lines buy nothing. | Measured with `awk NR`: 519 at merge-base, 539 at head. Diff shows `-<button id="TriageSetA" onAction="TriageSetA_Click" label="Set A" />` replaced by a six-line element. |
+| Medium | repository-wide (observed via `TaskMaster/TaskMaster.csproj`) | mandated type-check command | The policy-mandated `msbuild TaskMaster.sln /t:Build /p:Nullable=enable /p:TreatWarningsAsErrors=true` returns exit 0 without proving the tree is nullable-clean: MSBuild skips `CoreCompile` when only `/p:` values change. A forced `/t:Rebuild` of the changed project returns exit 1 with 195 errors, 64 of them `CS86xx`. | Raise a governance issue to make the type-check gate non-vacuous, for example by adding `/t:Rebuild` for changed projects or by setting `Nullable` in the project files rather than on the command line. | The gate as written cannot fail, so it provides no type-safety signal. This is pre-existing repository debt, not introduced here. | Independently reproduced this session. All 195 errors are in untouched files (`OutlookItemTry.cs` 35, `OutlookItemFlaggableTry.cs` 30, `ItemInfo.cs` 20, `PropertyStore.cs` 17); **zero** are attributable to any of the six new production files. Already recorded by the executor in `evidence/qa-gates/msbuild-nullable.2026-08-08T14-49.md` and routed in `evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md`. |
+| Low | `TaskMaster/Ribbon/EngineReadinessGate.cs` | lines 78-101, `TryGetEngine` | The readiness contract proves that the key is present and the stored `IConditionalEngine<MailItemHelper>` is non-null. It does not prove that the stored value is the concrete type the guarded handler goes on to dereference. `RibbonController.SB` performs `engine as SpamBayes` and returns null on a type mismatch, and `TestSpam_Click` dereferences `.Engine` on the dictionary value, neither of which the gate inspects. A residual `NullReferenceException` window therefore remains if a non-`SpamBayes` engine is ever registered under `"Spam"`, or if a registered engine's `.Engine` property is null. | Consider extending the catalog to carry the expected concrete type and having `TryGetEngine` verify it, or document the assumption explicitly in the gate's remarks. Not required for this fix. | The window is not reachable through the current `AppItemEngines.InitAsync()`, which registers a `SpamBayes` under `"Spam"`, so this is a latent robustness gap rather than a live defect. It is worth recording because the guard's stated purpose is to make the dereference unreachable. | Verified by reading `RibbonController.Intelligence.cs:190-202` (`engine as SpamBayes`) against `RibbonViewer.EngineCommands.cs:105` (`...InboxEngines[SpamBayes.GroupName].Engine`) and the gate's predicate at `EngineReadinessGate.cs:94`. |
+| Low | `TaskMaster/Ribbon/RibbonController.EngineCommands.cs` | line 36, `EngineCommands` property | `_engineCommandRunner ??= new EngineGatedCommandRunner(...)` is not thread-safe. Two threads querying `getEnabled` and a click handler concurrently could each construct a runner, and one instance would be discarded. | Optional: use `Lazy<EngineGatedCommandRunner>` with `LazyThreadSafetyMode.ExecutionAndPublication`, or leave as is with a comment recording that duplicate construction is harmless. | The consequence is benign — the runner holds no mutable state, the gate caches nothing, and the notification sink is a method group — so behaviour is unaffected. Recorded because ribbon callbacks and background continuations do reach this property from different threads. | Source inspection. `EngineReadinessGate` holds only a `Func<>`; `EngineGatedCommandRunner` holds only a gate and an `Action<string>`; neither mutates after construction. |
+| Low | `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/` | commit `d0955dc4` | The two full-detail Cobertura reports were replaced with package-level JaCoCo summaries after the fact. The aggregate figures are preserved and verified lossless, but the per-type table in `new-type-coverage.2026-08-08T14-54.md` and the per-file table in `coverage-comparison.2026-08-08T14-56.md` can no longer be re-derived from committed artifacts. | Make the summary-only convention an explicit repository rule, and have the summariser retain per-class counters for files touched by the change so per-type claims stay auditable. | The size concern is legitimate (~20 MB, ~374,000 lines for one bug fix), but the current substitution removes exactly the detail that acceptance criteria AC23 and AC24 assert against. | This review corroborated AC23 by an independent route: the `TaskMaster` package `LINE` counter moved from `missed=1464 covered=3329` to `missed=1464 covered=3515`, an increase of exactly 186 covered lines with zero increase in missed, and 186 is the exact line total of the four new types (48+48+72+18). |
+| Low | `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/` | `coverage-artifact-substitution.2026-08-08T17-40.md` | The filename timestamp (17-40) is later than both the commit that introduced the file (14:05) and the current wall clock. | Rename to the actual creation time on the next touch of this folder. | Chronological ordering of the evidence tree is how a reviewer reconstructs the execution sequence; a future-dated artifact breaks that. | `git log -1 --format=%ci -- <path>` reports `2026-08-08 14:05:40 -0400`; system clock at review time is `2026-08-08 14:14`. |
+
+## Design and Implementation Notes
+
+**What is done well, and worth preserving as a pattern.**
+
+The lambda-deferral technique is the load-bearing idea. Because the caller passes `() => Controller.SB.TrainAsync(Controller.OlSelection, true)` rather than a pre-evaluated task, the engine is dereferenced only inside the lambda body, and the lambda body runs only when the gate is open. This converts eight distinct dereference sites into one guarded call site without editing any of the eight expressions. The relocated handler bodies are byte-identical to their merge-base text apart from the wrapping, which was verified by reading the removed and added regions of `RibbonViewer.cs` side by side.
+
+The refusal to add a member to `IAppItemEngines` is correct and correctly justified. .NET Framework 4.8.1 has no default interface members, so any new member could only be bodied inside `AppItemEngines`, which is `[ExcludeFromCodeCoverage]` at type level; the new logic would have been entirely uncoverable. Reading the already-published `InboxEngines` member instead yields a zero-line diff on both fenced files, zero test-double churn, and full coverage of the decision. This is a better outcome than the acceptance criterion literally demanded.
+
+The choice not to route readiness through `RibbonController.SB` or `Triage` is a real correctness decision, not stylistic caution: those getters install a `WindowsFormsSynchronizationContext` on the calling thread as a side effect. The code comments record this, and the tests avoid those getters entirely. Likewise, `() => Globals?.Engines` is used rather than the existing `RibbonController.Engines` property because the latter is not null-safe on `Globals` — a distinction the author noticed and recorded rather than tripping over.
+
+`EngineCommandRefreshPlanner` deriving its invalidation set from `EngineCommandCatalog.ControlIds` rather than duplicating a literal list is what allows a single test to prove the XML, the callback, the guard, and the refresh all agree on the same eight ids. Asserting that set as set equality rather than sequence equality is correct, because Office documents callback ordering as unspecified.
+
+**Documentation quality.** The XML doc comments explain *why* consistently — why the type is not coverage-exempt, why the probe is per-key, why the marshalling is explicit rather than ambient, why each null-forgiving operator is present. The three null-forgiving operators each carry an adjacent comment recording that null is a supported value with a defined contract, which is the right way to use that operator.
+
+**Notification presentation.** The `Action<string>` sink is the correct seam: the decision to notify and the message content are host-neutral and unit-tested, while the presentation sits in the exempt shim. The delivered presentation is `logger.Warn` plus `MessageBox.Show`, which is a modal dialog rather than the "non-modal indication" the spec's prose suggested. The deviation is explicitly recorded in `spec.md` Deviation 1 with the rationale that the repository has no non-modal notice surface and introducing one would be scope creep for a bug fix. That reasoning is sound; the binding acceptance criterion (AC12) constrains only the sink contract, which is satisfied. Worth noting for follow-up: a modal dialog on every blocked click during a startup race could be intrusive if a user clicks repeatedly, since the runner emits one notification per blocked invocation rather than one per session.
+
+**Test-runner caveat for future reviewers.** Running `TaskMaster.Test.dll` under `Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` without `/Settings:TaskMaster.runsettings` produces 26 failures, all a `System.Threading.Tasks.Extensions, Version=4.2.0.1` load failure inside `Moq.Async.AwaitableFactory` caused by the app.config binding redirect not being applied. Three unrelated pre-existing tests fail identically under the same invocation, which is what identifies it as an environment artifact. The same 69 tests pass under `Common7\IDE\Extensions\TestPlatform\vstest.console.exe` with the runsettings file, which is the binary `scripts/vscode/Invoke-MSTestWithCoverage.ps1` resolves. CLAUDE.md CUT3 does not pin either choice.
+
+## Verdict
+
+**Approve, with the recorded findings as non-blocking follow-ups.** The Medium finding on the vacuous test assertion should be fixed, either in this change or in an immediate follow-up, because the acceptance criterion it is named against depends on it; the criterion itself remains genuinely enforced in the meantime by the sibling set-equality assertion. Nothing in this review requires a remediation plan or blocks PR creation.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T15-40.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T15-40.md
new file mode 100644
index 000000000..788439013
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T15-40.md
@@ -0,0 +1,74 @@
+# Code Review — ribbon-engine-readiness-guard (Issue #503)
+
+- Review timestamp: 2026-08-08T15-40
+- Cycle: **re-audit following remediation cycle 1**
+- Base branch: `main` @ `003c5715055d7d1933db68a742531332756e30b2`
+- Feature branch: `bug/ribbon-engine-readiness-guard-503` @ `85ff0ee4f0579a3622f2da3a21a6e942b3e4cd12`
+- Scope: full branch diff versus base — 13 `.cs`, 1 `.xml`, 2 `.csproj`, 107 documentation/evidence files
+
+## Executive Summary
+
+**No blockers.** The implementation is well-designed, and the design choice at its centre is the right one on the merits rather than the convenient one.
+
+The core insight is that a coarse `IsInitialized` flag would have been *incorrect*, not merely inelegant: `InitAsync()` filters engines on configuration and drops null factory results, so a global "initialized" signal would report ready for a command that will never work — converting a timing bug into a permanent one. The per-key probe avoids that, handles `RestartEngineAsync` for free because nothing is cached, and requires a zero-line diff to the two files the requirements fence off. The refusal to add an `IAppItemEngines` member is equally well-reasoned: on .NET Framework 4.8.1 there are no default interface members, so the member could only be bodied inside a `[ExcludeFromCodeCoverage]` class and the new decision logic would have been entirely uncoverable. Reading an existing interface member instead keeps every decision testable. That is the opposite of the anti-pattern where a coverage attribute is substituted for a real seam.
+
+The guard mechanism is also the right shape. Deferring the engine dereference into a `Func<Task>` lambda means the null-or-missing engine is never touched when the gate is closed, which converts both reported exception types into a no-op without scattering null-conditional operators through `RibbonViewer`. `EngineGatedCommandRunner` contains no `catch` clause of any kind, so it structurally cannot degenerate into a swallow-all — an exception from a ready action propagates unchanged, and there is a named test pinning that.
+
+Both findings from the first review were re-examined against the tree rather than accepted on report. **F1 is genuinely remediated**, with a mutate/fail/restore proof that is stronger than the usual claim: the mutation was verified present inside the built assembly before the test ran, a green control run on the unmutated resource is recorded, and the failure stack frame names the exact new assertion line. **F2 was correctly escalated rather than forced** — the formatter conflict was reproduced independently in this session by running CSharpier against a probe document, and the collapsed single-line form is genuinely rejected at 116 characters against a 100-column print width.
+
+Six findings are recorded below. All are Low or Informational; none blocks the PR. Three of them concern process artifacts (a commit message, the PR-context generator) rather than shipped code.
+
+## Findings Table
+
+| Severity | File | Location | Finding | Recommendation | Rationale | Evidence |
+|---|---|---|---|---|---|---|
+| Low | `TaskMaster/Ribbon/RibbonExplorer.xml` | whole file | File is 539 lines, above the 500-line guidance; grew from a pre-existing 519. The +20 decomposes into 8 functionally required `getEnabled` attributes and 12 formatter-mandated expansion lines. | Accept for this fix. Track a resource split (for example separating the Triage and SpamBayes groups into their own embedded parts) as its own issue rather than inside a bug fix. | The 500-line rule targets "production code, test code, or reusable script file"; this is a declarative embedded UI resource. The overage is pre-existing and none of the growth is discretionary — verified independently, not accepted on report. | `csharpier check` on a probe reproduction rejects the 116-char collapsed form; `.csharpierignore` has no `*.xml` exclusion; no `.csharpierrc` so print width is 100 |
+| Low | git history | commit `00bc47bb` | Commit subject reads "make the AC5 ribbon-XML assertion non-vacuous **and restore RibbonExplorer.xml line count**", but the commit contains no `RibbonExplorer.xml` change. F2 was escalated, not fixed. | Amend the subject if the branch is rebased before merge; otherwise ensure the PR body states plainly that F2 was closed as not remediable. | The surrounding documentation is accurate and discloses the escalation fully; only the commit subject overstates. A reader relying on `git log` alone would be misled about what shipped. | `git show --numstat 00bc47bb` lists no `.xml` path; `git diff --numstat <base>..<head> -- TaskMaster/Ribbon/RibbonExplorer.xml` shows the XML unchanged since the implementation commit |
+| Low | `artifacts/pr_context.summary.txt` | "Changed files overview" | Generator reported `Core logic changes: 0 files` and bucketed all 16 code paths as documentation. This is not cosmetic: the coverage hook derives its changed-language set from these bullets, so C# coverage enforcement would have been silently skipped. | Corrected in place during this review under a labelled `[REVIEWER CORRECTION]` block preserving the original output. Fix the generator's classifier as separate work. | Recurring generator defect on C#-touching branches; a reviewer who trusted the overview would produce an audit that omitted the only changed language. | Simulation of `Get-ChangedLanguageSet` returned an empty set before correction and `[CSharp]` after |
+| Low | `artifacts/pr_context.summary.txt` | "Close candidates" | Author-asserted autoclose list contains `#ISO-8601` — not an issue number — plus `#227` and `#424`, which appear in the feature documents only as precedent citations, not as issues this branch closes. | Before `gh pr create`, restrict closing keywords to `#503`. Do not emit closing keywords for `#227`, `#424`, or `#ISO-8601`. | An unfiltered autoclose list would close unrelated issues on merge. `#ISO-8601` is a regex false positive from the timestamp-format convention. | `artifacts/pr_context.summary.txt` "Auto-close issues (author asserted)" |
+| Informational | feature evidence folder | `evidence/**` filenames | Remediation-cycle evidence carries `14-52` timestamps that sort *before* implementation-cycle evidence at `14-56`, `14-58`, `15-00`, `15-05`, `15-10`, `15-12`, so filename ordering does not reflect execution order. | Prefer a monotonic clock reading per artifact write. No action needed for this PR. | Reduces auditability for a later reader reconstructing the sequence. The content is internally consistent and cross-referenced, so no conclusion is affected. | Directory listing of `evidence/`; the executor already recorded a related lesson about timestamp collisions |
+| Informational | untouched packages | `UtilitiesCS`, `QuickFiler` | Coverage measurement is nondeterministic: two runs over identical production code move `UtilitiesCS` by ±12 lines and `QuickFiler` by ±1, on an unchanged valid-line denominator. | None for this branch. Already promoted as its own potential entry. | Explains the apparent 17-line drift between the merge-base baseline and the final artifact without invoking a regression; no file in either package is in the diff. | Comparison of `coverage-remediation-baseline.jacoco.xml` against `coverage-remediation-final.jacoco.xml` |
+
+## Design and Implementation Notes
+
+### What is done well
+
+**The readiness contract is precise and its rationale is recorded in code, not just in the spec.** `EngineReadinessGate.TryGetEngine` checks all four conditions — non-null accessor result, non-null `InboxEngines`, key present, value non-null — and `IsEngineReady` delegates to it rather than duplicating the predicate. The XML doc comment explains *why* the probe is per-key rather than global, so a future maintainer who is tempted to "simplify" it to a boolean flag encounters the counter-argument at the point of change.
+
+**Ordinal case sensitivity is treated as a contract, not an accident.** The catalog builds its map with `StringComparer.Ordinal` to match the `ConcurrentDictionary` default, and there is an explicit test asserting `"spam"` is not `"Spam"`. That is the kind of detail that silently breaks later.
+
+**The single-source-of-truth catalog is what makes the XML/code agreement testable.** Because the eight control ids live in exactly one place, `RibbonExplorerXmlTests` can iterate `EngineCommandCatalog.ControlIds` and assert both directions: every catalog id declares the callback, and no element outside the catalog declares it. The negative assertion is the one that prevents over-disabling the ribbon, and it is genuinely load-bearing — it was the criterion that kept AC5 enforced while the AC5 test itself was vacuous.
+
+**The Office callback signature is pinned by reflection.** VSTO silently ignores a `getEnabled` callback whose signature does not match: the code compiles and nothing happens. The test asserts the method is public, instance, returns `bool`, and takes exactly one `Microsoft.Office.Core.IRibbonControl`. The comment explaining why the parameter is compared by `Type.FullName` rather than `typeof` — the test project carries no reference to the Office PIA, and a legacy non-SDK `ProjectReference` does not flow it — is exactly the kind of non-obvious constraint that deserves a comment.
+
+**The STA marshalling is explicit rather than ambient.** `InvalidateEngineCommands` checks `UiThread.Dispatcher.CheckAccess()` and marshals when needed, instead of assuming a captured synchronization context. The doc comment records why: `InitAsync()` is launched via `Task.Run` and only resumes on the STA when a context happened to be captured, which is not true on every load path. This is a real correctness concern, correctly handled.
+
+**Ordering is deliberately not asserted where the platform does not guarantee it.** `EngineCommandRefreshPlannerTests` asserts set equality against the catalog, with a comment stating that Office documents callback ordering as unspecified. Writing a sequence assertion here would have produced a test that passes today and fails unpredictably later.
+
+**Test doubles avoid a known side-effecting seam.** The tests deliberately do not reach readiness through `RibbonController.SB`/`Triage`, whose getters install a real `WindowsFormsSynchronizationContext` on the calling thread. The gate is exercised through its injected accessor instead. This trap is documented in the test class remarks.
+
+**The `RibbonViewer.cs` split is minimal.** The only source change in that file is `public class` → `public partial class`; the rest is region relocation. The split was necessary — the file was at 487/500 and could not have absorbed the new callbacks.
+
+### Points examined and found acceptable
+
+**The three null-forgiving operators.** `engine = null!`, `() => Globals?.Engines!`, and `control?.Id!` each carry an in-code comment recording that null is a *supported value* the consumer treats as "not ready", rather than an assertion that null cannot occur. Each is justified by a pinned non-nullable signature on the consuming side. These are honest annotations, not warning suppression, and each has a corresponding test proving the null path returns `false` instead of throwing.
+
+**`MessageBox.Show` in the notification sink.** A modal dialog is a coarse presentation for a "still loading" notice. The deviation is disclosed in `spec.md` Deviation 1 with the reasoning that the repository has no non-modal notice surface and introducing one is scope creep for a bug fix, and the mechanism matches six existing call sites in the same ribbon layer. Critically, the *decision* to notify and the message *content* are host-neutral and unit-tested through the injected sink; only presentation is exempt. No test constructs a `MessageBox`. This is the correct seam placement, and a nicer surface can be substituted later without touching the tested logic.
+
+**`BuildNotReadyMessage` looking up the rendered id.** The method looks up `renderedControlId` (which is `"(null)"` when the input was null) rather than the raw `controlId`. The comment explains the outcome is identical because `"(null)"` is not a catalog key so it still resolves to `"(unmapped)"`. Verified: the behaviour is the same and the test asserts the `"(unmapped)"` token appears.
+
+**Two new files inside `[ExcludeFromCodeCoverage]` types.** `RibbonController.EngineCommands.cs` and `RibbonViewer.EngineCommands.cs` are partials of types already exempt at type level, so they inherit the exemption without adding a new attribute. Their content is null checks plus single delegating calls; every decision they touch is made elsewhere and covered at 100%. This is the ratified COM/VSTO exemption applied to thin wiring only, which is the distinction the policy requires.
+
+**Ready-path preservation.** Compared the eight handlers against the merge-base line by line. Each relocated expression is character-for-character identical inside the lambda — for example `Controller.SB.TrainAsync(Controller.OlSelection, true)` and `_controller.Triage.OlLogic.TrainSelectionAsync("A")`, and the `TestSpam_Click` cast-and-index expression. Only the `await` moved outward to the runner. Behaviour once engines are loaded is unchanged.
+
+### Observations that are not findings
+
+`TestSpam_Click` remains the one handler using a dictionary indexer rather than `TryGetValue`. Inside the gated lambda this is now safe, because the lambda body is unreachable while the key is absent. Changing it to `TryGetValue` would alter the ready-path expression and violate the preservation requirement, so leaving it is correct for this fix.
+
+The commented-out legacy `TriageSet*_Click` lines were carried across in the region relocation. They were already present at the merge-base; removing them is unrelated cleanup that a bug fix should not absorb.
+
+## Verdict
+
+**APPROVE.** No blocking or high-severity findings. The change is minimal and targeted, the fix mechanism is sound, the test suite is deterministic and genuinely non-vacuous after F1, and the two prior-cycle findings were resolved correctly — one by remediation and one by a properly evidenced escalation.
+
+The remaining pre-merge obligation is not a code defect: AC19, AC20, and AC21 require a live Outlook profile and must be executed by the maintainer against the checklist already prepared in the feature folder.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/coverage-baseline.jacoco.xml b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/coverage-baseline.jacoco.xml
new file mode 100644
index 000000000..08b439c31
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/coverage-baseline.jacoco.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="3090" covered="14345" />
+    <counter type="BRANCH" missed="994" covered="3044" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="7509" covered="69233" />
+    <counter type="BRANCH" missed="3123" covered="16113" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="276" covered="2736" />
+    <counter type="BRANCH" missed="119" covered="649" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="1836" covered="1696" />
+    <counter type="BRANCH" missed="654" covered="594" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="1410" covered="2032" />
+    <counter type="BRANCH" missed="460" covered="468" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="106" covered="1374" />
+    <counter type="BRANCH" missed="32" covered="342" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="1464" covered="3329" />
+    <counter type="BRANCH" missed="387" covered="687" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="21" covered="556" />
+    <counter type="BRANCH" missed="16" covered="180" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="8" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-check.2026-08-08T13-08.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-check.2026-08-08T13-08.md
new file mode 100644
index 000000000..f3bfed381
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-check.2026-08-08T13-08.md
@@ -0,0 +1,25 @@
+# CSharpier Merge-Base Formatting Baseline — Issue #503 (P0-T6)
+
+Timestamp: 2026-08-08T13-08
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+Output Summary:
+
+```
+Checked 1488 files in 3810ms.
+EXIT_CODE=0
+```
+
+Measured merge-base unformatted set: **empty**. `csharpier check .` returned exit code 0 over 1488 files, so no file in the repository is unformatted at the merge-base.
+
+This measurement was performed by executing the command, not assumed. It matches the expected value recorded in the plan (`EXIT 0` over 1488 files), so there is no finding to record.
+
+This is the comparison basis for P6-T2: the post-change repo-wide check must also return `EXIT_CODE: 0`, because the merge-base unformatted set against which a non-zero result would be compared is empty.
+
+Note: this task is read-only. `csharpier format` was NOT run here.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-scope-rule.2026-08-08T13-14.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-scope-rule.2026-08-08T13-14.md
new file mode 100644
index 000000000..3ed61363a
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-scope-rule.2026-08-08T13-14.md
@@ -0,0 +1,42 @@
+# CSharpier Formatting-Scope Rule — Issue #503 (P0-T12)
+
+Timestamp: 2026-08-08T13-14
+
+Derived from: `<FEATURE>\evidence\baseline\csharpier-check.2026-08-08T13-08.md` (P0-T6)
+
+## Rule 5 of plan section 3, restated verbatim
+
+> **CSharpier scope guard.** `csharpier format` is invoked with the explicit scope-locked `.cs` path list from section 4 and is NEVER invoked repo-wide, and NEVER with `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` in its argument list. Reason: a repo-wide `csharpier format .` would reformat any file that is unformatted at the merge-base, which would break the AC15 zero-line-diff requirement. `csharpier check .` (read-only) is still run repo-wide as the comparison gate.
+
+## The thirteen scope-locked `.cs` paths P6-T1 may pass to `csharpier format`
+
+```
+TaskMaster\Ribbon\EngineCommandCatalog.cs
+TaskMaster\Ribbon\EngineReadinessGate.cs
+TaskMaster\Ribbon\EngineGatedCommandRunner.cs
+TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs
+TaskMaster\Ribbon\RibbonController.EngineCommands.cs
+TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs
+TaskMaster\Ribbon\RibbonViewer.cs
+TaskMaster\ThisAddIn.cs
+TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs
+TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs
+TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs
+TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs
+```
+
+That is exactly thirteen paths, matching plan section 4.5. No other path may be passed to `csharpier format` during this change.
+
+## Protected-file status in the P0-T6 unformatted set
+
+The P0-T6 measurement returned `EXIT_CODE: 0` over 1488 files, so the **merge-base unformatted set is empty**.
+
+- `TaskMaster\AppGlobals\AppItemEngines.cs` — **does NOT appear** in the P0-T6 unformatted set.
+- `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` — **does NOT appear** in the P0-T6 unformatted set.
+
+Because neither protected file is unformatted at the merge-base, no pre-existing-condition statement about deliberately leaving them unformatted is required. Both files are already CSharpier-clean, so their AC15 zero-line diff is not in tension with the formatter.
+
+The scope guard is nevertheless applied unchanged (plan decision D4): it is fail-safe if the measured state drifts during execution, and it makes the AC15 zero-line-diff guarantee structural rather than dependent on a measurement taken at Phase 0 time.
+
+EXIT_CODE: 0
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/file-line-counts.2026-08-08T13-13.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/file-line-counts.2026-08-08T13-13.md
new file mode 100644
index 000000000..895c27c4a
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/file-line-counts.2026-08-08T13-13.md
@@ -0,0 +1,44 @@
+# Merge-Base Line Counts of Scope-Locked Paths — Issue #503 (P0-T11)
+
+**ADVISORY.** The authoritative 500-line audit is P6-T3, measured after the final CSharpier format pass. These counts are recorded for the audit trail only.
+
+Timestamp: 2026-08-08T13-13
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; 'TaskMaster\Ribbon\RibbonViewer.cs','TaskMaster\Ribbon\RibbonExplorer.xml','TaskMaster\ThisAddIn.cs','TaskMaster\Ribbon\RibbonController.Intelligence.cs','TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs','TaskMaster\AppGlobals\AppItemEngines.cs','UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs' | ForEach-Object { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines }"
+```
+
+EXIT_CODE: 0
+
+## Output Summary — verbatim command output
+
+```
+TaskMaster\Ribbon\RibbonViewer.cs=363
+TaskMaster\Ribbon\RibbonExplorer.xml=519
+TaskMaster\ThisAddIn.cs=266
+TaskMaster\Ribbon\RibbonController.Intelligence.cs=360
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs=145
+TaskMaster\AppGlobals\AppItemEngines.cs=263
+UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs=16
+```
+
+## Measurement-method note (recorded so P6-T3 is not misread)
+
+`Measure-Object -Line` sums the line count of each input string and contributes **zero** for an empty string, so blank lines are not counted. The command therefore reports a **blank-line-excluding** count, which is lower than the physical line count of the file.
+
+Cross-check with physical line counts (`wc -l`), which is the measure the 500-line cap in `.claude/rules/general-code-change.md` is naturally read against:
+
+| Path | Command value (blank-excluding) | Physical lines | Plan-stated merge-base value |
+|---|---|---|---|
+| `TaskMaster\Ribbon\RibbonViewer.cs` | 363 | **487** | 487 |
+| `TaskMaster\Ribbon\RibbonExplorer.xml` | 519 | **519** | 519 |
+| `TaskMaster\ThisAddIn.cs` | 266 | **300** | 300 |
+| `TaskMaster\Ribbon\RibbonController.Intelligence.cs` | 360 | **412** | 412 |
+| `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | 145 | **161** | 161 |
+| `TaskMaster\AppGlobals\AppItemEngines.cs` | 263 | **286** | 286 |
+| `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` | 16 | **18** | 18 |
+
+The physical counts reproduce every merge-base figure stated in the plan and the research artifact exactly. `RibbonExplorer.xml` matches under both measures because it contains no blank lines.
+
+Consequence for P6-T3: the P6-T3 command (which uses the same `Measure-Object -Line` expression) will be executed verbatim as written, and its verbatim output recorded; the 500-line cap will additionally be evaluated against the **physical** line count, which is the stricter of the two measures. Using the stricter measure cannot weaken the AC25 gate.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/git-state.2026-08-08T13-06.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/git-state.2026-08-08T13-06.md
new file mode 100644
index 000000000..75cad49c8
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/git-state.2026-08-08T13-06.md
@@ -0,0 +1,47 @@
+# Git State Baseline — Issue #503 (P0-T4)
+
+Timestamp: 2026-08-08T13-06
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git rev-parse HEAD; git status --porcelain; git rev-parse 003c5715055d7d1933db68a742531332756e30b2"
+```
+
+EXIT_CODE: 0
+
+## Recorded state
+
+- HEAD SHA: `003c5715055d7d1933db68a742531332756e30b2` (audit record only; never used as a later equality gate)
+- Branch: `bug/ribbon-engine-readiness-guard-503`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2`
+- HEAD currently equals the merge-base. This is exactly why the plan mandates the commit tasks P0-T13, P4-T7, and P7-T32: without them every `<MERGE_BASE>..HEAD` diff gate would pass vacuously.
+
+## Verbatim `git status --porcelain`
+
+```
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md
+ M .claude/agent-memory/prd-feature/MEMORY.md
+M  .claude/agent-memory/task-researcher/MEMORY.md
+A  .claude/agent-memory/task-researcher/project_ribbon_engine_readiness_503.md
+AM docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md
+AM docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/plan.2026-08-08T11-59.md
+A  docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md
+AM docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
+A  docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md
+A  docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md
+?? .claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
+?? .claude/agent-memory/atomic-planner/csharpier-repowide-format-breaks-zero-diff-acs.md
+?? .claude/agent-memory/atomic-planner/diff-gates-need-a-commit-task.md
+?? .claude/agent-memory/atomic-planner/project_503_ribbon_readiness_plan_seams.md
+?? .claude/agent-memory/prd-feature/feedback_full_bug_spec_only.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/
+?? docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md
+?? docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md
+?? docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md
+```
+
+Output Summary: Porcelain is non-empty and contains only pre-implementation planning artifacts under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`, promoted entries under `docs/features/potential/promoted/`, `.claude/agent-memory/` updates, and the Phase 0 evidence folder written by P0-T1 through P0-T3.
+
+Binary outcome: **PASS** — no `.cs`, `.csproj`, `.xml`, or `.sln` path appears anywhere in the porcelain output.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-analyzers.2026-08-08T13-09.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-analyzers.2026-08-08T13-09.md
new file mode 100644
index 000000000..4e99645d1
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-analyzers.2026-08-08T13-09.md
@@ -0,0 +1,29 @@
+# MSBuild Analyzer Gate Baseline — Issue #503 (P0-T7)
+
+Timestamp: 2026-08-08T13-09
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+Output Summary:
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **5**
+- Elapsed: 00:00:01.48
+
+All 5 warnings are the same pre-existing, non-code diagnostic emitted once per `packages.config` project that transitively references System.Reactive 7.0.0:
+
+```
+packages\System.Reactive.7.0.0\build\System.Reactive.PackagesConfigCheck.targets(31,5): warning : The project contains a packages.config file, which is not supported by System.Reactive v7.0 or later. Please migrate to PackageReference.
+```
+
+Emitting projects: `QuickFiler.csproj`, `TaskMaster.csproj`, `UtilitiesCS.Test.csproj` (reported once per referencing path, 5 occurrences total).
+
+Zero analyzer rule diagnostics (no `CA`, `S`, `MA`, `RCS`, `AsyncFixer`, or `RS0030` IDs) appear in the log.
+
+Measured value matches the plan's expected merge-base value of EXIT 0. This is the comparison basis for P6-T4: the post-change analyzer build must report zero errors and no new analyzer diagnostic beyond these 5 pre-existing System.Reactive packaging warnings.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-nullable.2026-08-08T13-10.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-nullable.2026-08-08T13-10.md
new file mode 100644
index 000000000..5e9f602b7
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-nullable.2026-08-08T13-10.md
@@ -0,0 +1,21 @@
+# MSBuild Nullable / Type-Check Gate Baseline — Issue #503 (P0-T8)
+
+Timestamp: 2026-08-08T13-10
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+Output Summary:
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **5**
+- Elapsed: 00:00:01.65
+
+The 5 warnings are the identical pre-existing System.Reactive 7.0.0 `packages.config` packaging notices recorded in the P0-T7 baseline. They are emitted by an MSBuild `.targets` file rather than the compiler, so `/p:TreatWarningsAsErrors=true` does not promote them. Zero `CS86xx` nullable-flow diagnostics appear.
+
+Measured value matches the plan's expected merge-base value of EXIT 0. This is the comparison basis for P6-T5.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/nuget-restore.2026-08-08T13-07.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/nuget-restore.2026-08-08T13-07.md
new file mode 100644
index 000000000..65aa10d76
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/nuget-restore.2026-08-08T13-07.md
@@ -0,0 +1,26 @@
+# NuGet Restore Baseline — Issue #503 (P0-T5)
+
+Timestamp: 2026-08-08T13-07
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; nuget restore TaskMaster.sln; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+Output Summary:
+
+```
+MSBuild auto-detection: using msbuild version '18.8.2.30814' from 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin'.
+All packages listed in packages.config are already installed.
+  GET https://api.nuget.org/v3/vulnerabilities/index.json
+  OK https://api.nuget.org/v3/vulnerabilities/index.json 28ms
+  GET https://api.nuget.org/v3-vulnerabilities/2026.08.04.11.53.37/vulnerability.base.json
+  GET https://api.nuget.org/v3-vulnerabilities/2026.08.04.11.53.37/2026.08.07.23.53.58/vulnerability.update.json
+  OK https://api.nuget.org/v3-vulnerabilities/2026.08.04.11.53.37/vulnerability.base.json 35ms
+  OK https://api.nuget.org/v3-vulnerabilities/2026.08.04.11.53.37/2026.08.07.23.53.58/vulnerability.update.json 85ms
+EXIT_CODE=0
+```
+
+All `packages.config` packages were already installed in this worktree, so the restore was a no-op verification. The restore nevertheless ran and returned exit code 0, satisfying the section 3 rule 2 "restore before any build" precondition. No `log4net` / `SvgDocument` CS0246 risk remains.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-commit.2026-08-08T13-15.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-commit.2026-08-08T13-15.md
new file mode 100644
index 000000000..5d49eb36b
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-commit.2026-08-08T13-15.md
@@ -0,0 +1,23 @@
+# Phase 0 Commit — Issue #503 (P0-T13)
+
+Timestamp: 2026-08-08T13-15
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'docs(#503): planning artifacts and Phase 0 baseline evidence'; git status --porcelain; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+- New HEAD SHA: **`0f10bf305194dc53c67046e0a509dacedd977300`**
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2`
+- HEAD is no longer equal to the merge-base, so every later `<MERGE_BASE>..HEAD` diff gate is now meaningful rather than vacuous.
+- Post-commit `git status --porcelain`: **empty** (no output lines).
+
+Committed content: the pre-implementation planning artifacts (`issue.md`, `spec.md`, `plan.2026-08-08T11-59.md`, the research artifact), the five promoted potential entries under `docs/features/potential/promoted/`, the `.claude/agent-memory/` updates, and all thirteen Phase 0 evidence artifacts under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/` including `coverage-baseline.cobertura.xml`.
+
+No `.cs`, `.csproj`, `.xml`, or `.sln` source file was included in this commit; the source tree is still byte-identical to the merge-base at this point.
+
+Binary outcome: **PASS** — HEAD advanced past `<MERGE_BASE>` and porcelain is empty.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-inputs-read.2026-08-08T13-05.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-inputs-read.2026-08-08T13-05.md
new file mode 100644
index 000000000..359d4a40a
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-inputs-read.2026-08-08T13-05.md
@@ -0,0 +1,27 @@
+# Phase 0 Feature Inputs Read — Issue #503 (P0-T3)
+
+Timestamp: 2026-08-08T13-05
+
+Files read (absolute paths):
+
+1. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md`
+2. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\issue.md`
+3. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\research\2026-08-08T12-45-ribbon-engine-readiness-guard-research.md`
+
+Resolved work mode: **`full-bug`**, taken from the persisted marker `- Work Mode: full-bug` at `issue.md:12` and restated at `spec.md:9`.
+
+AC source resolution per `.claude\skills\acceptance-criteria-tracking\SKILL.md`: work mode `full-bug` resolves the authoritative acceptance-criteria source to **`spec.md` only**. No `user-story.md` exists for this issue and none is to be created.
+
+AC count: **30** criteria, `AC1` through `AC30`, all under the `## Acceptance Criteria` heading of `spec.md` and all currently `- [ ]`.
+
+Non-AC checkboxes explicitly excluded from the AC set (severity markers, must not be modified):
+
+- `spec.md` `## Impact / Severity`: `- [ ] Blocker`, `- [x] High`, `- [ ] Medium`, `- [ ] Low`
+- `issue.md` `## Impact / Severity`: same four
+- `issue.md` `## Logs / Screenshots`, `## Proposed Fix / Validation Ideas`, `## Next Step` checkboxes
+
+MANUAL-ONLY criteria that must remain `- [ ]` at plan completion: **AC19**, **AC20**, **AC21**.
+
+Output Summary: All three feature inputs were read before implementation began. Work mode is `full-bug`; `spec.md` is the sole AC source with 30 criteria (AC1-AC30); three of those (AC19, AC20, AC21) are MANUAL-ONLY and are left unchecked by design.
+
+EXIT_CODE: 0
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-instructions-read.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-instructions-read.md
new file mode 100644
index 000000000..c032a9bed
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-instructions-read.md
@@ -0,0 +1,26 @@
+# Phase 0 Instructions Read — Issue #503 (P0-T2)
+
+Timestamp: 2026-08-08T13-03
+
+Policy Order: as defined by `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\policy-compliance-order\SKILL.md` — (1) `CLAUDE.md`, (2) `.claude/rules/general-code-change.md`, (3) `.claude/rules/general-unit-test.md`, (4) language/domain-specific rules for the files in scope (C#), then the remaining repository rules that bear on this change.
+
+Files read, in order, with absolute paths:
+
+1. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\CLAUDE.md`
+2. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\general-code-change.md`
+3. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\general-unit-test.md`
+4. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\csharp.md`
+5. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\architecture-boundaries.md`
+6. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\quality-tiers.md`
+7. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\tonality.md`
+
+Supporting skill files read for execution mechanics:
+
+- `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\policy-compliance-order\SKILL.md`
+- `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\atomic-plan-contract\SKILL.md`
+- `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\evidence-and-timestamp-conventions\SKILL.md`
+- `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\acceptance-criteria-tracking\SKILL.md`
+
+Output Summary: All seven policy files were read in the mandated order before any implementation task ran. Binding constraints extracted for this change: MSTest + Moq + FluentAssertions only; no temporary files in tests; no `Thread.Sleep` / `Task.Delay` / direct wall-clock reads in tests; no broad `catch (Exception)` without a defined boundary; 500-line file cap on production, test, and reusable script files (Markdown exempt); toolchain order format -> lint -> type-check -> test with a restart from step 1 on any failure or file mutation; CSharpier is the formatter and `dotnet format` is prohibited; new modules/classes/methods must reach >= 90% coverage; `[ComVisible(true)]` must not be added to new runtime code; new runtime code must not add `Microsoft.Office.Interop.Outlook` or `Microsoft.Office.Tools.*` references.
+
+EXIT_CODE: 0
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/preexisting-failures.2026-08-08T13-12.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/preexisting-failures.2026-08-08T13-12.md
new file mode 100644
index 000000000..9a644a716
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/preexisting-failures.2026-08-08T13-12.md
@@ -0,0 +1,33 @@
+# Pre-Existing Failing / Flaky Test Set — Issue #503 (P0-T10)
+
+Timestamp: 2026-08-08T13-12
+
+Source run: P0-T9, `<FEATURE>\evidence\baseline\tests-with-coverage.2026-08-08T13-11.md` (6293 total, 6293 passed, 0 failed, 0 skipped, `Test Run Successful.`)
+
+## Failing tests observed in P0-T9
+
+**None.** The P0-T9 baseline run reported zero failures. The observed pre-existing failure set from that run is therefore the empty set.
+
+## The pre-existing set (recorded)
+
+The recorded pre-existing set for the purposes of the Phase 6 pass rule contains exactly one member:
+
+| Fully-qualified name | File | Tracking issue | Status |
+|---|---|---|---|
+| `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` | `UtilitiesCS.Test\OutlookObjects\Folder\WpfDispatcherYieldTests.cs` | **#508** | Pre-existing order-dependent flake; OUT OF SCOPE for #503 |
+
+This test is a pre-existing, order-dependent flake under parallel execution. It has been observed failing on some merge-base runs and passing on others with no code change (2 failures on one orchestrator baseline run, 1 on the next, and 0 on the P0-T9 run recorded here). It is already promoted to issue **#508** and is explicitly out of scope for issue #503.
+
+It is included in the recorded pre-existing set even though it passed on the P0-T9 run, because its failure is nondeterministic across runs and a Phase 6 occurrence would otherwise be misread as a regression introduced by #503.
+
+## The final-QC pass rule (verbatim)
+
+> A Phase 6 test run passes when the only failures are members of this recorded set; any test not in this set that fails is a real regression that restarts the Phase 6 loop at P6-T1; issue #508 must not be fixed inside this change.
+
+## Search scope for this determination
+
+- SearchScope: the full P0-T9 vstest console output at `C:\Users\DANMOI~1\AppData\Local\Temp\claude\C--Users-DanMoisan-repos-TaskMaster-wt-2026-08-08T11-55\ef7e1b49-f808-435f-8b58-e04bac54f30b\scratchpad\p0t9.log`
+- SearchPatterns: `Failed`, `Skipped`, `Total tests`, `Test Run`
+- SearchResult: `Test Run Successful.` / `Total tests: 6293` / `Passed: 6293`; no `Failed:` or `Skipped:` line was emitted.
+
+EXIT_CODE: 0
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/tests-with-coverage.2026-08-08T13-11.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/tests-with-coverage.2026-08-08T13-11.md
new file mode 100644
index 000000000..cec15ddbc
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/tests-with-coverage.2026-08-08T13-11.md
@@ -0,0 +1,50 @@
+# Full-Suite Test and Coverage Baseline — Issue #503 (P0-T9)
+
+Timestamp: 2026-08-08T13-11
+
+Command:
+```
+pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\baseline\coverage-baseline.cobertura.xml
+```
+(run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`)
+
+EXIT_CODE: 0
+
+Coverage artifact: `docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\baseline\coverage-baseline.cobertura.xml` (10,410,066 bytes)
+
+## Output Summary
+
+### Test counts
+
+| Metric | Value |
+|---|---|
+| Result | `Test Run Successful.` |
+| Total tests | **6293** |
+| Passed | **6293** |
+| Failed | **0** |
+| Skipped | **0** |
+| Total time | 39.8451 seconds |
+
+The runner emits `Passed:` only when `Failed:` and `Skipped:` are zero; `Test Run Successful.` confirms zero failures. The pre-existing order-dependent flake `YieldAsync_WithoutDispatcher_RemainsStrict` (issue #508) did **not** reproduce on this baseline run.
+
+### Measured root `<coverage>` attributes (verbatim from the emitted XML)
+
+| Attribute | Measured value |
+|---|---|
+| `line-rate` | **0.858477** |
+| `branch-rate` | **0.79237** |
+| `lines-covered` | **95309** |
+| `lines-valid` | **111021** |
+| `branches-covered` | 22077 |
+| `branches-valid` | 27862 |
+| `complexity` | 24646 |
+
+### Divergence from the plan's reference values — recorded as a finding
+
+The plan (P0-T9) records these expected merge-base reference values: total 6293, `line-rate` 0.7042636529201906, `branch-rate` 0.5849570138678879, `lines-covered` 56458, `lines-valid` 80166.
+
+The test count matches exactly (6293). The four coverage attributes do **not** match. The measured values are recorded verbatim above and have **not** been overwritten with the reference values, per the explicit instruction in P0-T9.
+
+Assessment: the divergence is a counting-method / instrumentation-scope difference, not a code difference. HEAD is byte-identical to the merge-base for all `.cs`, `.csproj`, `.xml`, and `.sln` paths (P0-T4 binary outcome), so no source change can account for it. The reference figures were produced by a different extraction path than `Invoke-MSTestWithCoverage.ps1`'s post-processed Cobertura output (the script's final step is `Post-processing coverage XML for Koverage compatibility`, which rewrites the document; the denominator this repository's `dotnet-coverage` path produces is known to vary with instrumentation scope).
+
+Impact on the plan: **none, and no gate is weakened.** AC24 (P6-T8) is a baseline-versus-final comparison, and P6-T6 runs the identical command with the identical post-processing, so both sides of the comparison are produced by the same counting method. The absolute repo-wide figure is a record-and-report obligation under D6, not a blocking floor. The blocking coverage gate for #503 remains the >= 0.90 per-type line rate for the four new types (P6-T7), which is extracted from the same document by the same query on both sides.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/toolchain-availability.2026-08-08T13-01.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/toolchain-availability.2026-08-08T13-01.md
new file mode 100644
index 000000000..a7954d531
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/toolchain-availability.2026-08-08T13-01.md
@@ -0,0 +1,24 @@
+# Toolchain Availability Baseline — Issue #503 (P0-T1)
+
+Timestamp: 2026-08-08T13-01
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Test-Path 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe'; (Get-Command nuget -ErrorAction SilentlyContinue) -ne $null; (Get-Command dotnet-coverage -ErrorAction SilentlyContinue) -ne $null"
+```
+
+EXIT_CODE: 0
+
+Output Summary:
+
+| Tool | Path / probe | Result |
+|---|---|---|
+| csharpier | `C:\Users\DanMoisan\.dotnet\tools\csharpier.exe` | True |
+| MSBuild | `C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe` | True |
+| vstest.console | `C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` | True |
+| nuget | `Get-Command nuget` | True |
+| dotnet-coverage | `Get-Command dotnet-coverage` | True |
+
+All five required tools resolve `True`. No install step was required; `dotnet tool install --global dotnet-coverage` was NOT run because `dotnet-coverage` already resolved `True`.
+
+Binary outcome: PASS — all five tools resolve `True` in the final recorded state.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/ac-status-summary.2026-08-08T15-10.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/ac-status-summary.2026-08-08T15-10.md
new file mode 100644
index 000000000..7a71f3462
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/ac-status-summary.2026-08-08T15-10.md
@@ -0,0 +1,62 @@
+# Acceptance Criteria Status Summary — Issue #503 (P7-T31)
+
+Timestamp: 2026-08-08T15-10
+
+### Acceptance Criteria Status
+
+- Source: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md`
+- Work mode: `full-bug` (persisted in `issue.md`), so `spec.md` is the **sole** authoritative AC source per `.claude/skills/acceptance-criteria-tracking/SKILL.md`. No `user-story.md` exists and none was created.
+- Total AC items: **30**
+- Checked off (delivered): **27**
+- Remaining (unchecked): **3**
+- Items remaining:
+  - **AC19** — MANUAL-ONLY. Pending maintainer execution of the P7-T1 checklist. Requires a running Outlook process and a live mail profile to click each of the eight engine-backed commands during the initialization window and confirm no `NullReferenceException` / `KeyNotFoundException` and a "still loading" indication.
+  - **AC20** — MANUAL-ONLY. Pending maintainer execution of the P7-T1 checklist. Requires live Outlook to confirm each of the eight commands behaves exactly as before once initialization completes.
+  - **AC21** — MANUAL-ONLY. Pending maintainer execution of the P7-T1 checklist. Requires live Outlook to observe Office greying the eight buttons during initialization and re-enabling them after the invalidation fires, without an add-in restart. Office's callback-caching behaviour is internal to the host and is not locally observable.
+
+## Verification of the counts against the file on disk
+
+```
+grep -cE '^- \[x\] \*\*AC' spec.md   =>  27
+grep -cE '^- \[ \] \*\*AC' spec.md   =>   3
+grep -oE '^\- \[ \] \*\*AC[0-9]+' spec.md
+  => - [ ] **AC19
+     - [ ] **AC20
+     - [ ] **AC21
+```
+
+The counts in this artifact match the actual checkbox state of `spec.md`.
+
+## Delivered criteria and their evidence
+
+| AC | Evidence |
+|---|---|
+| AC1 | `qa-gates/no-coverage-exclusion.2026-08-08T14-10.md`, `qa-gates/office-surface-audit.2026-08-08T14-12.md`, `qa-gates/tests-with-coverage.2026-08-08T14-52.md` |
+| AC2 | `EngineReadinessGateTests` results in `qa-gates/tests-with-coverage.2026-08-08T14-52.md` |
+| AC3 | `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` |
+| AC4 | `Constructor_WithNullAccessor_ThrowsArgumentNullException` |
+| AC5 | `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` |
+| AC6 | `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` |
+| AC7 | `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` |
+| AC8 | `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` |
+| AC9 | `EngineCommandCatalogTests` results |
+| AC10 | `qa-gates/lambda-deferral-audit.2026-08-08T14-18.md` + `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` |
+| AC11 | `regression-testing/fail-before-503.2026-08-08T13-22.md`, `regression-testing/pass-after-503.2026-08-08T13-32.md` |
+| AC12 | `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName` + `qa-gates/test-determinism-audit.2026-08-08T14-15.md` |
+| AC13 | `RunAsync_WithNullAction_ThrowsArgumentNullException`, `RunAsync_WithUnknownControlId_DoesNotInvokeAction` |
+| AC14 | `RunAsync_WhenActionThrows_PropagatesException` + `qa-gates/no-new-broad-catch.2026-08-08T14-14.md` |
+| AC15 | `qa-gates/zero-line-diff-postformat.2026-08-08T14-59.md` |
+| AC16 | `qa-gates/ready-path-preservation.2026-08-08T14-20.md` + `RunAsync_WhenEngineReady_InvokesActionExactlyOnce`, `RunAsync_WhenEngineReady_AwaitsActionToCompletion` |
+| AC17 | `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId`, `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException` |
+| AC18 | `qa-gates/refresh-wiring-audit.2026-08-08T14-22.md` |
+| AC22 | `qa-gates/toolchain-clean-pass.2026-08-08T14-58.md` — P6-T6 failure set is **empty**, so AC22 was checked off directly with no reconciliation note required |
+| AC23 | `qa-gates/new-type-coverage.2026-08-08T14-54.md` — all four types at 1.000000 |
+| AC24 | `baseline/coverage-baseline.cobertura.xml`, `qa-gates/coverage-final.cobertura.xml`, `qa-gates/coverage-comparison.2026-08-08T14-56.md` |
+| AC25 | `qa-gates/file-size-audit.2026-08-08T14-47.md` (post-format authoritative audit) |
+| AC26 | `qa-gates/no-coverage-exclusion.2026-08-08T14-10.md` |
+| AC27 | `qa-gates/office-surface-audit.2026-08-08T14-12.md` |
+| AC28 | `qa-gates/test-determinism-audit.2026-08-08T14-15.md` + the `BannedSymbols.txt` / `RS0030` result in `qa-gates/msbuild-analyzers.2026-08-08T14-35.md` |
+| AC29 | `issue-updates/out-of-scope-promotions.2026-08-08T15-05.md` (#504, #505, #506, #507, #508) |
+| AC30 | `spec.md` `## Delivery Notes and Deviations`, `issue.md` `## Delivered Outcome`, plan `Status: Executed`, and `manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` |
+
+Non-AC checkboxes were not modified: the `- [ ] Blocker` / `- [x] High` / `- [ ] Medium` / `- [ ] Low` severity markers under `## Impact / Severity` in both `spec.md` and `issue.md` are untouched, as are the `## Logs / Screenshots`, `## Proposed Fix / Validation Ideas`, and `## Next Step` checkboxes in `issue.md`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md
new file mode 100644
index 000000000..eb20c48b5
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md
@@ -0,0 +1,39 @@
+# Out-of-Scope Defect Promotions (AC29) — Issue #503 (P7-T28)
+
+Timestamp: 2026-08-08T15-05
+
+## Promotion receipts
+
+Each defect catalogued in research section 9, plus the pre-existing test flake discovered during baseline capture, was promoted to its own GitHub issue **upstream of this plan**:
+
+| Research section 9 defect | Issue | Local promoted entry |
+|---|---|---|
+| Five orphan `onAction` callbacks in `RibbonExplorer.xml` (`_Clicked` vs `_Click` suffix mismatch on `BtnMigrateIDs_Click`, `MoveEntireConversation_Clicked`, `SaveAttachments_Clicked`, `SaveEmailCopy_Clicked`, `SavePictures_Clicked`) | **#504** | `docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md` |
+| Invalid `getPressed` callback signatures (`async Task<bool>` instead of the documented `bool`) on `SpamBayesEnabled_GetPressed` and `TriageEnabled_GetPressed` | **#505** | `docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md` |
+| Fire-and-forget `ToggleEngineAsync` in `SpamBayesEnabled_Click` / `TriageEnabled_Click` (task and any exception discarded in a `void` method) | **#506** | `docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md` |
+| `RibbonController.Engines` is not null-safe on `Globals` (`RibbonController.Intelligence.cs:204`), unlike the sibling `SB`/`Triage` properties | **#507** | `docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md` |
+| Pre-existing order-dependent flake `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` | **#508** | `docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md` |
+
+## Explicit statements required by P7-T28
+
+1. **These were promoted upstream of this plan.** All five promotions were performed before execution of this plan began; the five `docs/features/potential/promoted/` entries were already present in the working tree at the P0-T4 git-state capture and were committed by P0-T13.
+
+2. **No promotion lifecycle call was made inside #503.** This plan does not invoke the promotion lifecycle. AC29 is satisfied by recording the five issue numbers above, exactly as plan section 6 specifies.
+
+3. **No fix for any of them was made inside #503.** The section 4 scope lock permits no edit to any file implicated by #504, #505, #506, or #507, and section 3 rule 7 plus decision D7 explicitly forbid fixing #508. Verification:
+   - The five orphan `onAction` attributes in `RibbonExplorer.xml` are untouched: the branch diff of that file is `23 3`, and all 23 added lines are the eight `getEnabled="EngineCommand_GetEnabled"` attributes plus the reformatting of the three `TriageSet*` buttons to one-attribute-per-line (see `<FEATURE>\evidence\qa-gates\zero-line-diff-postformat.2026-08-08T14-59.md`).
+   - `SpamBayesEnabled_GetPressed` and `TriageEnabled_GetPressed` were relocated verbatim by P3-T4 and are byte-identical to their merge-base text; their signatures are unchanged (`<FEATURE>\evidence\qa-gates\office-surface-audit.2026-08-08T14-12.md` establishes that all 26 relocated members are moves, not modifications).
+   - `SpamBayesEnabled_Click` and `TriageEnabled_Click` were likewise relocated verbatim; the fire-and-forget `ToggleEngineAsync` call is unchanged.
+   - `RibbonController.Intelligence.cs` does not appear in the branch diff at all, so `RibbonController.Engines` is unchanged. This change deliberately does **not** use it as the readiness accessor, building `new EngineReadinessGate(() => Globals?.Engines!)` instead, precisely because of #507.
+   - `UtilitiesCS.Test/` does not appear in the branch diff (`git diff --name-only <MERGE_BASE>..HEAD -- UtilitiesCS.Test/` returns 0 paths), so #508 was not touched.
+
+## Additional defects discovered during execution (recorded for the orchestrator, not fixed, not promoted here)
+
+Two further out-of-scope conditions were observed while executing this plan. Neither is fixed by this change, and neither is promoted by this plan; they are recorded so the orchestrator can route them:
+
+| Condition | Evidence | Why not fixed |
+|---|---|---|
+| `CS2002` duplicate `<Compile Include>` for `OutlookObjects\Folder\PercentageFormatterTests.cs` in `UtilitiesCS.Test\UtilitiesCS.Test.csproj`. Present at the merge-base (`grep -c` returns 2); surfaced only when `UtilitiesCS.Test` was forced to recompile. | `<FEATURE>\evidence\other\phase2-build.2026-08-08T13-30.md`, `<FEATURE>\evidence\qa-gates\msbuild-analyzers.2026-08-08T14-35.md` | `UtilitiesCS.Test.csproj` is outside the section 4 scope lock. |
+| Large pre-existing nullable debt in `TaskMaster.csproj`: 220 `CS86xx` errors under a forced `/t:Rebuild /p:Nullable=enable /p:TreatWarningsAsErrors=true`, concentrated in `AppOlObjects.cs` (58), `AppAutoFileObjects.cs` (52), `AppToDoObjects.cs` (48), `AppOlObjects.FolderTreeService.cs` (48), `AppStagingFilenames.cs` (40), `ApplicationGlobals.cs` (40), `AppItemEngines.cs` (18) and others. The plan-specified `/t:Build` gate does not surface it because MSBuild's up-to-date check skips `CoreCompile` when only `/p:` values change. | `<FEATURE>\evidence\qa-gates\msbuild-nullable.2026-08-08T14-49.md` | Every implicated file is outside the section 4 scope lock, and two of them (`AppItemEngines.cs`, `ApplicationGlobals.cs`) are AC15-protected zero-line-diff paths that must not be edited. |
+
+A third, purely cosmetic observation: `spec.md` ends with two stray lines, `</content>` and `</invoke>`, left by the authoring tool. This is a documentation artifact with no effect on any gate; it is recorded rather than removed, since `spec.md` content outside the acceptance-criteria checkboxes is not this plan's to edit.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md
new file mode 100644
index 000000000..ee2d13c85
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md
@@ -0,0 +1,140 @@
+# Manual Verification Checklist — AC19, AC20, AC21 (Issue #503)
+
+Timestamp: 2026-08-08T15-00
+
+Status: PENDING MAINTAINER EXECUTION
+
+## Why this checklist exists
+
+AC19, AC20, and AC21 are **MANUAL-ONLY**. They require a running Outlook process, a live mail profile, and physical clicks on the Office ribbon. There is no Outlook UI-automation harness in this repository, and the general unit-test policy prohibits tests that depend on external processes. These three criteria must **never** be checked off in `spec.md` on the strength of unit tests, source inspection, or any automated artifact. They remain `- [ ]` until a maintainer executes the steps below and records the outcome here.
+
+## Scope: the eight engine-backed commands
+
+| # | Ribbon control id | Label | Backing engine |
+|---|---|---|---|
+| 1 | `TrainSpam` | Train Spam | `Spam` |
+| 2 | `TrainHam` | Train Ham | `Spam` |
+| 3 | `TestSpam` | Test Spam | `Spam` |
+| 4 | `TriageSetA` | Set A | `Triage` |
+| 5 | `TriageSetB` | Set B | `Triage` |
+| 6 | `TriageSetC` | Set C | `Triage` |
+| 7 | `ClearTriage` | Clear Triage Field | `Triage` |
+| 8 | `FilterTriageGroup` | Filter | `Triage` |
+
+`TrainSpam` and `TrainHam` are on the `SpamBayesGroup` group. `TestSpam` is inside the `OtherSpamActions` menu. `TriageSetA`/`B`/`C` are on the `TriageGroup` group. `FilterTriageGroup` and `ClearTriage` are inside the `OtherTriageActions` menu. All are on the "Taskmaster" tab of the Outlook Explorer ribbon.
+
+---
+
+## Step 1 — Clicks during initialization produce no exception (satisfies **AC19**)
+
+Reload the TaskMaster add-in (or restart Outlook) so `AppItemEngines.InitAsync()` begins. **Before initialization completes**, click each of the eight engine-backed commands listed above.
+
+For each, confirm:
+
+- No `NullReferenceException` appears in the log.
+- No `KeyNotFoundException` appears in the log (this is specifically the `TestSpam` path, which uses a dictionary indexer).
+- A "still loading" indication appears, naming the command and its engine.
+
+Log location: the log4net log configured by `TaskMaster\log4net.config`.
+
+| # | Control | No `NullReferenceException`? | No `KeyNotFoundException`? | "Still loading" indication shown? |
+|---|---|---|---|---|
+| 1 | `TrainSpam` | | | |
+| 2 | `TrainHam` | | | |
+| 3 | `TestSpam` | | | |
+| 4 | `TriageSetA` | | | |
+| 5 | `TriageSetB` | | | |
+| 6 | `TriageSetC` | | | |
+| 7 | `ClearTriage` | | | |
+| 8 | `FilterTriageGroup` | | | |
+
+Overall Step 1 outcome (PASS / FAIL / NOT RUN): ______________
+Executed by: ______________    Date: ______________
+Notes: ______________
+
+---
+
+## Step 2 — Office visually greys the eight buttons during initialization (satisfies **AC21**, first half)
+
+During the same initialization window, before clicking anything, observe the ribbon.
+
+Confirm each of the eight controls renders **disabled** (greyed). Also confirm that controls this fix does not own remain **enabled** — in particular the save-location, folder-settings, and enable-toggle commands inside the `OtherSpamActions` and `OtherTriageActions` menus, and the menus themselves.
+
+| # | Control | Rendered disabled during init? |
+|---|---|---|
+| 1 | `TrainSpam` | |
+| 2 | `TrainHam` | |
+| 3 | `TestSpam` | |
+| 4 | `TriageSetA` | |
+| 5 | `TriageSetB` | |
+| 6 | `TriageSetC` | |
+| 7 | `ClearTriage` | |
+| 8 | `FilterTriageGroup` | |
+
+Non-engine controls in the same menus remained enabled (Yes / No): ______________
+
+Overall Step 2 outcome (PASS / FAIL / NOT RUN): ______________
+Executed by: ______________    Date: ______________
+Notes: ______________
+
+---
+
+## Step 3 — The eight buttons become enabled after initialization, without an add-in restart (satisfies **AC21**, second half)
+
+Wait for initialization to complete (the log records "Finished loading globals"). Do **not** restart Outlook or reload the add-in.
+
+Confirm each of the eight controls becomes **enabled**.
+
+This step is what proves two things that cannot be observed locally: that the post-initialization `IRibbonUI.InvalidateControl` refresh actually fired, and that the `getEnabled` callback is genuinely bound. VSTO silently ignores a callback signature mismatch — the code compiles and nothing happens — so only a live load can demonstrate binding.
+
+| # | Control | Became enabled without restart? |
+|---|---|---|
+| 1 | `TrainSpam` | |
+| 2 | `TrainHam` | |
+| 3 | `TestSpam` | |
+| 4 | `TriageSetA` | |
+| 5 | `TriageSetB` | |
+| 6 | `TriageSetC` | |
+| 7 | `ClearTriage` | |
+| 8 | `FilterTriageGroup` | |
+
+Overall Step 3 outcome (PASS / FAIL / NOT RUN): ______________
+Executed by: ______________    Date: ______________
+Notes: ______________
+
+---
+
+## Step 4 — Each command behaves exactly as before once enabled (satisfies **AC20**)
+
+With initialization complete and the buttons enabled, exercise each of the eight commands against a suitable mail selection and confirm the behaviour is identical to the pre-change behaviour.
+
+| # | Control | Expected behaviour | Behaves as before? |
+|---|---|---|---|
+| 1 | `TrainSpam` | Trains the selection as spam (`SB.TrainAsync(OlSelection, true)`) | |
+| 2 | `TrainHam` | Trains the selection as ham (`SB.TrainAsync(OlSelection, false)`) | |
+| 3 | `TestSpam` | Runs the spam test over the selection (`SpamBayes.TestAsync(OlSelection)`) | |
+| 4 | `TriageSetA` | Trains the selection into Triage set "A" | |
+| 5 | `TriageSetB` | Trains the selection into Triage set "B" | |
+| 6 | `TriageSetC` | Trains the selection into Triage set "C" | |
+| 7 | `ClearTriage` | Untrains the selection (`UnTrainSelectionAsync()`) | |
+| 8 | `FilterTriageGroup` | Applies the Triage filter view (`FilterViewAsync()`) | |
+
+Overall Step 4 outcome (PASS / FAIL / NOT RUN): ______________
+Executed by: ______________    Date: ______________
+Notes: ______________
+
+---
+
+## Acceptance-criteria mapping
+
+| Step | Acceptance criterion |
+|---|---|
+| Step 1 | **AC19** |
+| Step 2 | **AC21** (visual disable during initialization) |
+| Step 3 | **AC21** (re-enable after invalidation, without restart) |
+| Step 4 | **AC20** |
+
+## Check-off instruction for the maintainer
+
+After executing the steps and recording the outcomes above, check off AC19, AC20, and AC21 in
+`docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md` **only** for the criteria whose steps recorded PASS. Leave any criterion whose step recorded FAIL or NOT RUN as `- [ ]`, and record the gap.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/manual-only-unchecked.2026-08-08T15-01.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/manual-only-unchecked.2026-08-08T15-01.md
new file mode 100644
index 000000000..f66681037
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/manual-only-unchecked.2026-08-08T15-01.md
@@ -0,0 +1,42 @@
+# MANUAL-ONLY Criteria Remain Unchecked — Issue #503 (P7-T2)
+
+Timestamp: 2026-08-08T15-01
+
+Source file audited: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md`
+
+Command:
+```
+grep -nE "^\- \[.\] \*\*AC(19|20|21)" spec.md
+```
+
+## The three criterion lines, quoted verbatim from `spec.md`
+
+Line 456:
+
+```
+- [ ] **AC19 (R5b, A3) — MANUAL-ONLY.** In a live Outlook Explorer, immediately after add-in reload and before initialization completes, each of the eight engine-backed ribbon commands is clicked and produces no `NullReferenceException` and no `KeyNotFoundException` in the log, and shows the "still loading" indication. Requires a running Outlook process and a live mail profile; **must not be checked off on the strength of unit tests.** Outcome recorded under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/`.
+```
+
+Line 457:
+
+```
+- [ ] **AC20 (R5b, A2, A3) — MANUAL-ONLY.** In the same live session, after `InitAsync()` completes, each of the eight commands behaves exactly as it did before this change. Requires live Outlook; outcome recorded under `.../evidence/manual-verification/`.
+```
+
+Line 458:
+
+```
+- [ ] **AC21 (R5c, A4) — MANUAL-ONLY.** In a live Outlook session, Office visually greys the eight buttons during initialization and re-enables them after the post-`InitAsync()` invalidation fires, without an add-in restart. This also confirms the `getEnabled` callback is actually bound, which VSTO does not report on a signature mismatch. Office's callback-caching behavior is internal to the host and is not locally observable; **must not be checked off on the strength of unit tests.** Outcome recorded under `.../evidence/manual-verification/`.
+```
+
+## Assertion
+
+| Criterion | Line | Prefix | Still `- [ ]`? |
+|---|---|---|---|
+| AC19 | 456 | `- [ ] **AC19` | **Yes** |
+| AC20 | 457 | `- [ ] **AC20` | **Yes** |
+| AC21 | 458 | `- [ ] **AC21` | **Yes** |
+
+Binary outcome: **PASS** — all three remain `- [ ]`.
+
+Checking any of them off from unit-test or source-inspection evidence would be a policy violation, and no such check-off was made. Their maintainer checklist is at `<FEATURE>\evidence\manual-verification\ac19-ac21-checklist.2026-08-08T15-00.md`, which carries `Status: PENDING MAINTAINER EXECUTION`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/final-worktree-state.2026-08-08T15-12.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/final-worktree-state.2026-08-08T15-12.md
new file mode 100644
index 000000000..972a23bb7
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/final-worktree-state.2026-08-08T15-12.md
@@ -0,0 +1,46 @@
+# Final Worktree State — Issue #503 (P7-T32)
+
+Timestamp: 2026-08-08T15-12
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'docs(#503): Phase 5-7 verification evidence and acceptance-criteria check-offs'; git status --porcelain"
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+- Commit created successfully (`COMMIT_EXIT=0`).
+- HEAD SHA: **`aa0417d255252bf730690d23a09229770043ae37`**
+- Post-commit `git status --porcelain`: **empty** (no output lines).
+
+## Commit history for this change
+
+| Task | Commit | Content |
+|---|---|---|
+| P0-T13 | `0f10bf305194dc53c67046e0a509dacedd977300` | Planning artifacts and Phase 0 baseline evidence |
+| P4-T7 | `f09e3cf81bf9d79714e7f30b2bd583013594a482` | The fix itself: six new production files, four modified production paths, six new/modified test-project paths |
+| P7-T32 | `aa0417d255252bf730690d23a09229770043ae37` | Phase 5-7 verification evidence, the CSharpier format pass, the three nullable annotations, the acceptance-criteria check-offs, and the delivery documentation |
+
+Merge-base: `003c5715055d7d1933db68a742531332756e30b2`. HEAD is three commits ahead, so every `<MERGE_BASE>..HEAD` diff gate in this plan observed a real change set rather than passing vacuously.
+
+## Evidence artifact completeness
+
+All 45 evidence artifacts named anywhere in the plan exist on disk under `docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\` and are **tracked** by git. Verified by running `git ls-files --error-unmatch` against every file found under the evidence tree; zero files reported `UNTRACKED`.
+
+Distribution by canonical evidence kind:
+
+| Kind | Artifacts |
+|---|---|
+| `evidence/baseline/` | 14 |
+| `evidence/regression-testing/` | 4 |
+| `evidence/qa-gates/` | 21 |
+| `evidence/other/` | 3 |
+| `evidence/manual-verification/` | 2 |
+| `evidence/issue-updates/` | 2 |
+| **Total** | **46** |
+
+All artifacts are under the canonical `<FEATURE>/evidence/<kind>/` scheme required by `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`. No artifact was written to `artifacts/baselines/`, `artifacts/qa/`, `artifacts/coverage/`, or `artifacts/evidence/`. No non-canonical evidence path was supplied by the caller, so no `EVIDENCE_LOCATION_OVERRIDE_REJECTED` record is required.
+
+Binary outcome: **PASS** — `git status --porcelain` returns no lines, and every artifact path named in the plan exists on disk and is tracked.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-postrestore.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-postrestore.2026-08-08T14-52.md
new file mode 100644
index 000000000..771e7e4f4
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-postrestore.2026-08-08T14-52.md
@@ -0,0 +1,48 @@
+# Phase 1 — Post-Restore Build and Embedded-Content Assertion (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T9]
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'"`
+EXIT_CODE: 0
+
+Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`
+EXIT_CODE: 0
+
+## Output Summary
+
+### Build
+
+```text
+    6 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:07.99
+```
+
+Zero errors. Six warnings, all pre-existing: five `System.Reactive` packages.config advisories plus the `CS2002` duplicate-compile warning in `UtilitiesCS.Test.csproj` (issue **#510**, out of scope).
+
+### Embedded-content assertion
+
+```text
+EMBEDDED_GETENABLED_COUNT=8
+EMBEDDED_TRIAGESETA_SINGLELINE=False
+EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:07:05.2659559Z
+```
+
+- **`EMBEDDED_GETENABLED_COUNT=8`** — the assembly under test again carries all eight attributes. The P1-T8 restoration has propagated into the built artifact, so the P1-T10 pass-after run reads the restored resource rather than the mutated one.
+- `EMBEDDED_TRIAGESETA_SINGLELINE=False` — still expected; F2 (Phase 2) has not run yet.
+- `EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:07:05.2659559Z` — advanced past the mutated-build value `2026-08-08T19:04:58.9399552Z`, confirming the assembly was rewritten rather than left carrying the mutation.
+
+### Embedded-resource write-time sequence across Phase 1
+
+| Task | Embedded `getEnabled` count | Assembly write time (UTC) |
+|---|---|---|
+| P0-T3 (baseline) | 8 | 2026-08-08T17:48:38.5907327Z |
+| P1-T3 (pre-mutation) | 8 | 2026-08-08T18:57:19.8234515Z |
+| P1-T6 (mutated) | **7** | 2026-08-08T19:04:58.9399552Z |
+| P1-T9 (restored) | 8 | 2026-08-08T19:07:05.2659559Z |
+
+Monotonically increasing write times with the count dropping to 7 only in the mutation window is direct evidence that no measurement in this phase was taken against a stale assembly.
+
+Binary outcome satisfied: the helper reports `EMBEDDED_GETENABLED_COUNT=8`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-premutation.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-premutation.2026-08-08T14-52.md
new file mode 100644
index 000000000..3d3d9bb4b
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-premutation.2026-08-08T14-52.md
@@ -0,0 +1,45 @@
+# Phase 1 — Pre-Mutation Build and Embedded-Content Assertion (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T3]
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'"`
+EXIT_CODE: 0
+
+Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`
+EXIT_CODE: 0
+
+## Output Summary
+
+### Build
+
+```text
+    5 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:02.29
+```
+
+Zero errors. The five warnings are the pre-existing `System.Reactive` packages.config advisories recorded in the P0-T9 and P0-T10 baselines.
+
+### Assembly write times (confirming the corrected test actually compiled)
+
+| Assembly | LastWriteTimeUtc |
+|---|---|
+| `TaskMaster.Test\bin\Debug\TaskMaster.Test.dll` | 2026-08-08 19:03:12 |
+| `TaskMaster.Test\bin\Debug\TaskMaster.dll` | 2026-08-08 18:57:19 |
+
+`TaskMaster.Test.dll` was rewritten by this build, which confirms the P1-T1 edit to `RibbonExplorerXmlTests.cs` was compiled rather than skipped by the incremental up-to-date check. `TaskMaster.dll` was not rewritten, which is correct: `RibbonExplorer.xml` has not changed at this point in the plan, so the embedded resource is already current.
+
+### Embedded-content assertion
+
+```text
+EMBEDDED_GETENABLED_COUNT=8
+EMBEDDED_TRIAGESETA_SINGLELINE=False
+EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T18:57:19.8234515Z
+```
+
+- `EMBEDDED_GETENABLED_COUNT=8` — the assembly under test carries all eight `getEnabled="EngineCommand_GetEnabled"` attributes. This is the **unmutated** state, which is what P1-T4 needs in order to establish that the corrected assertion is green before the mutation.
+- `EMBEDDED_TRIAGESETA_SINGLELINE=False` — expected; F2 has not run yet.
+
+Binary outcome satisfied: the build exits 0 and the helper reports `EMBEDDED_GETENABLED_COUNT=8`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T13-30.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T13-30.md
new file mode 100644
index 000000000..ab79030e4
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T13-30.md
@@ -0,0 +1,39 @@
+# Phase 2 Analyzer Build — Issue #503 (P2-T5)
+
+Timestamp: 2026-08-08T13-30
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **6**
+
+The four new host-neutral decision types compile and are wired into the `TaskMaster` assembly:
+
+- `TaskMaster\Ribbon\EngineCommandCatalog.cs`
+- `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs`
+- `TaskMaster\Ribbon\EngineGatedCommandRunner.cs`
+- `TaskMaster\Ribbon\EngineReadinessGate.cs`
+
+The two P1 regression tests in `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` now compile; the four `CS0246` diagnostics recorded in the P1-T2 fail-before artifact are resolved. Zero analyzer rule diagnostics (`CA`, `S`, `MA`, `RCS`, `AsyncFixer`, `RS0030`) are emitted for any new file.
+
+### Warning reconciliation against the P0-T7 baseline (5 warnings)
+
+| Warning | Count | Status |
+|---|---|---|
+| `System.Reactive.PackagesConfigCheck.targets(31,5): warning : The project contains a packages.config file, which is not supported by System.Reactive v7.0 or later` | 5 | Pre-existing; identical to the P0-T7 baseline |
+| `CSC : warning CS2002: Source file '...\UtilitiesCS.Test\OutlookObjects\Folder\PercentageFormatterTests.cs' specified multiple times [UtilitiesCS.Test.csproj]` | 1 | **Pre-existing, out of scope** — see below |
+
+The `CS2002` warning is a duplicate `<Compile Include>` item for `OutlookObjects\Folder\PercentageFormatterTests.cs` in `UtilitiesCS.Test\UtilitiesCS.Test.csproj`. It is **not** introduced by #503:
+
+- `git show 003c5715055d7d1933db68a742531332756e30b2:UtilitiesCS.Test/UtilitiesCS.Test.csproj | grep -c "PercentageFormatterTests.cs"` returns **2** at the merge-base, so the duplicate item already exists there.
+- `git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD -- UtilitiesCS.Test/` returns **0** paths, so this branch has not touched that project at all.
+
+It did not appear in the P0-T7 baseline only because that build was incrementally up to date and skipped `CoreCompile` for `UtilitiesCS.Test`; the Phase 2 change to the `TaskMaster` assembly forced a recompile of the dependent test project, which surfaced the latent warning. `UtilitiesCS.Test.csproj` is outside the plan's section 4 scope lock, so per rule 10 the defect is recorded here for the orchestrator rather than fixed.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T14-52.md
new file mode 100644
index 000000000..c134b87e3
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T14-52.md
@@ -0,0 +1,49 @@
+# Phase 2 — Post-Collapse Build and Embedded-Content Assertion (Cycle 1, Issue #503)
+
+> **SUPERSEDED — this measurement no longer describes the tree.** The P2-T1 collapse was **reverted** at [P3-T2]; `EMBEDDED_TRIAGESETA_SINGLELINE` is `False` again and the embedded resource is back to the formatter-mandated multi-line form. See `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`. The record below is retained as the evidence of the attempt. The `EMBEDDED_GETENABLED_COUNT=8` finding is unaffected by the revert.
+
+Timestamp: 2026-08-08T14-52
+Task: [P2-T4]
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'"`
+EXIT_CODE: 0
+
+Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`
+EXIT_CODE: 0
+
+## Output Summary
+
+### Build
+
+```text
+    6 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:07.97
+```
+
+Zero errors. Six warnings, all pre-existing: five `System.Reactive` packages.config advisories plus the `CS2002` duplicate-compile warning in `UtilitiesCS.Test.csproj` (issue **#510**, out of scope).
+
+### Embedded-content assertion
+
+```text
+EMBEDDED_GETENABLED_COUNT=8
+EMBEDDED_TRIAGESETA_SINGLELINE=True
+EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:09:25.8990703Z
+```
+
+- **`EMBEDDED_GETENABLED_COUNT=8`** — all eight `getEnabled="EngineCommand_GetEnabled"` attributes survive the collapse in the built artifact, not merely on disk.
+- **`EMBEDDED_TRIAGESETA_SINGLELINE=True`** — the gate condition, and the first time in this cycle it reports `True`. The helper tests for the exact byte sequence `<button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />` inside the embedded resource, so the collapsed single-line form is confirmed in the assembly the tests read.
+- `EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:09:25.8990703Z` — advanced past the P1-T9 post-restore value `2026-08-08T19:07:05.2659559Z`, confirming the assembly was rewritten and P2-T5 will not read a stale artifact.
+
+### Full embedded-resource sequence across Phases 0-2
+
+| Task | Embedded `getEnabled` count | TriageSetA single-line | Assembly write time (UTC) |
+|---|---|---|---|
+| P0-T3 (baseline) | 8 | False | 2026-08-08T17:48:38.5907327Z |
+| P1-T3 (pre-mutation) | 8 | False | 2026-08-08T18:57:19.8234515Z |
+| P1-T6 (mutated) | **7** | False | 2026-08-08T19:04:58.9399552Z |
+| P1-T9 (restored) | 8 | False | 2026-08-08T19:07:05.2659559Z |
+| **P2-T4 (collapsed)** | **8** | **True** | 2026-08-08T19:09:25.8990703Z |
+
+Binary outcome satisfied: the helper reports `EMBEDDED_GETENABLED_COUNT=8` **and** `EMBEDDED_TRIAGESETA_SINGLELINE=True`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase3-build.2026-08-08T13-48.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase3-build.2026-08-08T13-48.md
new file mode 100644
index 000000000..0896c5414
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase3-build.2026-08-08T13-48.md
@@ -0,0 +1,31 @@
+# Phase 3 Analyzer Build — Issue #503 (P3-T8)
+
+Timestamp: 2026-08-08T13-48
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **6** — identical to the P2-T5 set: 5 pre-existing System.Reactive `packages.config` notices plus 1 pre-existing `CS2002` duplicate-`Compile` warning in `UtilitiesCS.Test.csproj` (both reconciled in `<FEATURE>\evidence\other\phase2-build.2026-08-08T13-30.md`). No new warning was introduced by Phase 3.
+
+Phase 3 changes verified as compiling and wired:
+
+| Change | Path |
+|---|---|
+| `public class` -> `public partial class` (one line) | `TaskMaster\Ribbon\RibbonViewer.cs` |
+| New controller partial with `IsEngineCommandEnabled` / `RunEngineCommandAsync` / `RefreshEngineCommands` / `NotifyEngineCommandNotReady` | `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` |
+| New viewer partial with `EngineCommand_GetEnabled` / `InvalidateEngineCommands` plus the relocated `#region Spam Manager` and `#region Triage` blocks and the eight rewritten handlers | `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` |
+| Eight `getEnabled="EngineCommand_GetEnabled"` attributes | `TaskMaster\Ribbon\RibbonExplorer.xml` |
+| One `_ribbonController.RefreshEngineCommands();` plus why-comment | `TaskMaster\ThisAddIn.cs` |
+| Six `<Compile Include>` entries | `TaskMaster\TaskMaster.csproj` |
+
+## Execution note
+
+`RibbonViewer.EngineCommands.cs` initially declared `using UtilitiesCS.Threading;` for `UiThread`, which failed with `CS0103: The name 'UiThread' does not exist in the current context`. The type is declared in `UtilitiesCS\Threading\UiThread.cs` but its namespace is `UtilitiesCS`, not `UtilitiesCS.Threading`. The using directive was corrected to `using UtilitiesCS;` and the XML doc comment now names the fully-qualified `UtilitiesCS.UiThread.Dispatcher`. This is a namespace-vs-folder discrepancy in the existing source, not a change to the marshalling design required by AC18.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase4-commit.2026-08-08T14-05.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase4-commit.2026-08-08T14-05.md
new file mode 100644
index 000000000..6bd78015c
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase4-commit.2026-08-08T14-05.md
@@ -0,0 +1,40 @@
+# Phase 1-4 Commit — Issue #503 (P4-T7)
+
+Timestamp: 2026-08-08T14-05
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'fix(#503): engine-readiness guard for engine-backed ribbon commands'; git status --porcelain; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+- New HEAD SHA: **`f09e3cf81bf9d79714e7f30b2bd583013594a482`**
+- Post-commit `git status --porcelain`: **empty**
+
+`git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD`, restricted to non-documentation paths (that is, excluding `docs/` and `.claude/`), lists exactly the section 4 scope-lock source set and nothing else:
+
+```
+TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+TaskMaster.Test/TaskMaster.Test.csproj
+TaskMaster/Ribbon/EngineCommandCatalog.cs
+TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+TaskMaster/Ribbon/EngineReadinessGate.cs
+TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+TaskMaster/Ribbon/RibbonExplorer.xml
+TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+TaskMaster/Ribbon/RibbonViewer.cs
+TaskMaster/TaskMaster.csproj
+TaskMaster/ThisAddIn.cs
+```
+
+Sixteen paths: six new production files, six new/modified test-project paths, and four modified production paths. The three AC15-protected paths (`TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, `TaskMaster/AppGlobals/ApplicationGlobals.cs`) are absent.
+
+Binary outcome: **PASS** — the diff gates in Phase 5 and Phase 6 now observe the real change set, and the worktree is clean.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-artifact-substitution.2026-08-08T17-40.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-artifact-substitution.2026-08-08T17-40.md
new file mode 100644
index 000000000..23cf714ce
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-artifact-substitution.2026-08-08T17-40.md
@@ -0,0 +1,64 @@
+# Coverage Artifact Substitution (Issue #503)
+
+Timestamp: 2026-08-08T17-40
+Decision by: orchestrator
+Command: `pwsh -NoProfile -File <scratchpad>/ConvertCoverage.ps1 -Source <cobertura> -Destination <jacoco>`
+EXIT_CODE: 0
+
+## What changed
+
+The atomic executor committed two raw full-detail Cobertura reports as evidence:
+
+- `evidence/baseline/coverage-baseline.cobertura.xml` — 187,115 lines, ~10.4 MB
+- `evidence/qa-gates/coverage-final.cobertura.xml` — 187,491 lines, ~10.4 MB
+
+Together these added roughly 20 MB and 374,000 lines to permanent git history for a single bug fix. Because every feature would repeat this, the raw reports were replaced with compact package-level JaCoCo summaries that carry the identical measured totals:
+
+- `evidence/baseline/coverage-baseline.jacoco.xml`
+- `evidence/qa-gates/coverage-final.jacoco.xml`
+
+No number was recomputed, adjusted, or re-run. The summaries are a lossless projection of the per-line `hits` and `condition-coverage` attributes in the source reports onto JaCoCo `<counter type="LINE">` / `<counter type="BRANCH">` elements, aggregated per package.
+
+## Verified totals (derived from the committed source reports before substitution)
+
+| Report | Cobertura root `line-rate` | Derived LINE | Cobertura root `branch-rate` | Derived BRANCH |
+|---|---|---|---|---|
+| Baseline (merge-base) | 0.858477 | 95309 covered / 15712 missed = **85.85%** | 0.79237 | 22077 covered / 5785 missed = **79.24%** |
+| Final (post-change) | 0.858516 | 95473 covered / 15734 missed = **85.85%** | 0.792487 | 22131 covered / 5795 missed = **79.25%** |
+
+The derived percentages agree with the source `line-rate`/`branch-rate` root attributes to two decimal places, which is the check that establishes the projection is lossless.
+
+Delta: line coverage +0.000039, branch coverage +0.000117. **No coverage regression.** Both figures sit above the `.claude/rules/general-unit-test.md` floors (line >= 85%, branch >= 75%).
+
+## Denominator note (important)
+
+These figures are measured over the nine first-party solution packages: `QuickFiler`, `SVGControl`, `Tags`, `TaskMaster`, `TaskTree`, `TaskVisualization`, `ToDoModel`, `UtilitiesCS`, `VBFunctions`. Vendored third-party assemblies (`log4net`, `Microsoft.IO.RecyclableMemoryStream`, `Mono.Reflection`, `System.Interactive`, `System.Linq.Async`) are excluded by `coverage.config`, and no `*.Test` assembly appears in the denominator.
+
+An unfiltered run that includes the vendored packages reports a materially lower figure (line-rate 0.7045 over 80,166 valid lines). That unfiltered number is **not** the policy denominator: `.claude/rules/general-unit-test.md` requires coverage tooling to be configured so metrics reflect application code, and CLAUDE.md § UT2 defines the floor against the testable first-party denominator. The filtered 85.85% is the figure of record. This distinction is recorded because the two runs differ by more than 15 percentage points and the discrepancy would otherwise look like a measurement error.
+
+## Canonical gate artifact
+
+`artifacts/csharp/coverage.xml` was generated from `evidence/qa-gates/coverage-final.cobertura.xml` by the same lossless projection, for consumption by `.claude/hooks/validate-feature-review-coverage.ps1`. That hook parses JaCoCo `<counter>` elements and cannot read Cobertura, which is why the format conversion is required rather than optional.
+
+Verified by invoking the hook's own parsers against the generated file:
+
+```text
+hook reads repo-wide LINE: 85.85 %  (floor 85)
+hook reads BRANCH: 79.25 %  (floor 75)
+```
+
+`artifacts/` is gitignored (`.gitignore:57`), so this file is local-only by repository convention and is regenerated rather than committed.
+
+## Regeneration
+
+To reproduce the raw reports:
+
+```powershell
+pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug
+```
+
+This writes full-detail Cobertura to `coverage/coverage.cobertura.xml`. Note that this default invocation does **not** apply the same package filtering as the run that produced the committed evidence; see the denominator note above.
+
+## Output Summary
+
+Two ~10 MB raw Cobertura reports replaced by lossless package-level JaCoCo summaries. Baseline and final line coverage both 85.85%; branch 79.24% to 79.25%. No regression, both floors met, all four new types at 100% line coverage per `new-type-coverage.2026-08-08T14-54.md`. Roughly 20 MB and 374,000 lines kept out of permanent git history.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md
new file mode 100644
index 000000000..e63dbf287
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md
@@ -0,0 +1,70 @@
+# Phase 3 QC Step 9 — Coverage Comparison for Remediation Cycle 1 (Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T9]
+
+All three points are measured on the **same first-party nine-package denominator** (`QuickFiler`, `SVGControl`, `Tags`, `TaskMaster`, `TaskTree`, `TaskVisualization`, `ToDoModel`, `UtilitiesCS`, `VBFunctions`) using the **same all-descendant `<line>` counting method**. The counting method was verified commensurable at P0-T12 by reproducing the implementation-cycle `TaskMaster` package counter (`missed=1464 covered=3515`) exactly; see `evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md` for the recorded correction.
+
+## Three-point comparison
+
+| Point | Source artifact | LINE covered | LINE missed | LINE % | BRANCH covered | BRANCH missed | BRANCH % |
+|---|---|---|---|---|---|---|---|
+| **A** Implementation-cycle post-change | `evidence/qa-gates/coverage-final.jacoco.xml` | 95473 | 15734 | 85.8516 | 22131 | 5795 | 79.2487 |
+| **B** Remediation baseline (P0-T12) | `evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml` | 95467 | 15740 | **85.8462** | 22133 | 5793 | **79.2559** |
+| **C** Remediation final (P3-T7) | `evidence/qa-gates/coverage-remediation-final.jacoco.xml` | 95478 | 15729 | **85.8561** | 22137 | 5789 | **79.2702** |
+
+### The binding delta: C against B
+
+| Metric | B (baseline) | C (final) | Delta | Verdict |
+|---|---|---|---|---|
+| LINE % | 85.8462 | **85.8561** | **+0.0099** | **C >= B** — no regression |
+| BRANCH % | 79.2559 | **79.2702** | **+0.0143** | **C >= B** — no regression |
+| LINE covered | 95467 | 95478 | +11 | up |
+| LINE missed | 15740 | 15729 | -11 | down |
+| BRANCH covered | 22133 | 22137 | +4 | up |
+| BRANCH missed | 5793 | 5789 | -4 | down |
+| LINE denominator | 111207 | 111207 | 0 | identical |
+| BRANCH denominator | 27926 | 27926 | 0 | identical |
+
+Both derived percentages at C are **greater than or equal to** the B values to two decimal places (85.85 >= 85.85; 79.27 >= 79.26). There is no shortfall to explain.
+
+## `TaskMaster` package LINE counter at all three points
+
+| Point | `TaskMaster` LINE |
+|---|---|
+| A — implementation-cycle post-change | `missed=1464 covered=3515` |
+| B — remediation baseline | `missed=1464 covered=3515` |
+| C — remediation final | `missed=1464 covered=3515` |
+
+**Byte-identical at all three points.** This is the direct measurement that no production line changed coverage state in this cycle, and it is the same package-level identity the feature review used to corroborate AC23.
+
+## Why production coverage is expected to be unchanged
+
+This cycle changes **one test file** (`TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, the F1 assertion body) and, after the P2-T1 revert recorded in `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`, **no embedded XML resource** — `TaskMaster\Ribbon\RibbonExplorer.xml` takes a zero-line diff. Neither a test-file edit nor an XML resource edit adds or removes a production line, so production line coverage is expected to be unchanged, and it is: the `TaskMaster` package counter is identical at all three points.
+
+The residual +11 line and +4 branch movement in the aggregate is run-to-run instrumentation variance, concentrated in `QuickFiler` (-1 covered) and `UtilitiesCS` (+12 covered). At 11 lines out of a 111,207-line denominator this is under 0.01 percent and is of the same order as the variance already recorded between points A and B, which bracket **no change at all** to the tree. It is not attributable to this cycle's edit.
+
+## Denominator note (restated from `coverage-artifact-substitution.2026-08-08T17-40.md`)
+
+These figures are measured over the nine first-party solution packages. Vendored third-party assemblies (`log4net`, `Microsoft.IO.RecyclableMemoryStream`, `Mono.Reflection`, `System.Interactive`, `System.Linq.Async`) are excluded by `coverage.config`, and no `*.Test` assembly appears in the denominator.
+
+An unfiltered run that includes the vendored packages reports a materially lower figure. **That unfiltered number is not the policy denominator**: `.claude/rules/general-unit-test.md` requires coverage tooling to be configured so metrics reflect application code, and CLAUDE.md § UT2 defines the floor against the testable first-party denominator. The filtered figure is the figure of record. This is recorded because the two runs differ by more than 15 percentage points and the discrepancy would otherwise look like a measurement error.
+
+## Documented threshold conflict — recorded, not resolved
+
+The repository states two different coverage floors in two different governing documents:
+
+| Source | Line floor | Branch floor | New-code floor |
+|---|---|---|---|
+| `CLAUDE.md` § UT2 and `.claude/rules/csharp.md` | **80%** repo-wide | not stated | **90%** for new modules/classes/methods |
+| `.claude/rules/general-unit-test.md` and `.claude/rules/quality-tiers.md` | **85%** | **75%** | not stated |
+
+This conflict is **unresolved repository governance**, and it is recorded here rather than silently resolved by selecting whichever number is convenient. It is not load-bearing for this cycle's verdict: the measured figures (LINE 85.8561, BRANCH 79.2702) clear **every** floor in both sets simultaneously.
+
+The 90-percent new-code floor has no subject in this cycle. No new module, class, or method is introduced; the only change is the body of an existing test method, and test code is excluded from the coverage denominator by policy.
+
+## Verdict
+
+**No coverage regression.** LINE and BRANCH both moved up against the remediation baseline on an identical denominator, the `TaskMaster` package counter is unchanged, and every stated floor is cleared.
+
+Binary outcome satisfied: the derived first-party LINE and BRANCH percentages at P3-T7 are greater than or equal to the P0-T12 values to two decimal places. No shortfall occurred, so none is recorded.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-56.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-56.md
new file mode 100644
index 000000000..03a945106
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-56.md
@@ -0,0 +1,83 @@
+# AC24 Coverage Comparison — Issue #503 (P6-T8)
+
+Timestamp: 2026-08-08T14-56
+
+Inputs:
+
+- Baseline: `<FEATURE>\evidence\baseline\coverage-baseline.cobertura.xml` (P0-T9, merge-base `003c5715055d7d1933db68a742531332756e30b2`)
+- Final: `<FEATURE>\evidence\qa-gates\coverage-final.cobertura.xml` (P6-T6)
+- Per-type new-code figures: `<FEATURE>\evidence\qa-gates\new-type-coverage.2026-08-08T14-54.md` (P6-T7)
+
+Both artifacts were produced by the identical command (`scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug`), so both sides of every figure below share one counting method.
+
+## Repo-wide comparison
+
+| Metric | Baseline (P0-T9) | Final (P6-T6) | Delta |
+|---|---|---|---|
+| `line-rate` | 0.858477 | **0.858516** | **+0.000039** |
+| `branch-rate` | 0.79237 | **0.792487** | **+0.000117** |
+| `lines-covered` | 56458 -> measured 95309 | **95473** | **+164** |
+| `lines-valid` | 80166 -> measured 111021 | **111207** | **+186** |
+| `branches-covered` | 22077 | 22131 | +54 |
+| `branches-valid` | 27862 | 27926 | +64 |
+| Total tests | 6293 | **6338** | +45 |
+| Failed | 0 | **0** | 0 |
+| Skipped | 0 | **0** | 0 |
+
+Both rates moved **up**, not down. 164 of the 186 newly-valid lines are covered.
+
+Note on the `lines-covered` / `lines-valid` row: the plan recorded reference merge-base values of 56458 / 80166, but the P0-T9 measurement of the same command produced 95309 / 111021. The measured values were recorded verbatim per the P0-T9 instruction and the divergence was analysed there (a counting-method / instrumentation-scope difference in how the reference figures were extracted, not a code difference — HEAD was byte-identical to the merge-base for all source paths at that point). The comparison above uses the **measured** baseline on both sides, so it is internally consistent.
+
+## Per-type new-code coverage (P6-T7)
+
+| Type | Line rate | >= 0.90 floor |
+|---|---|---|
+| `TaskMaster.EngineCommandCatalog` | **1.000000** | PASS |
+| `TaskMaster.EngineReadinessGate` | **1.000000** | PASS |
+| `TaskMaster.EngineGatedCommandRunner` | **1.000000** | PASS |
+| `TaskMaster.EngineCommandRefreshPlanner` | **1.000000** | PASS |
+
+## Changed-line no-regression statement
+
+Every `.cs` path in the plan's section 4 scope lock, compared file-by-file between the two Cobertura documents (line coverage recomputed as covered `<line>` elements over total `<line>` elements per `filename`):
+
+| Path | Baseline | Final | Regression? |
+|---|---|---|---|
+| `TaskMaster\Ribbon\EngineCommandCatalog.cs` | absent (file did not exist) | **48/48 = 1.000000** | No — new file at 100% |
+| `TaskMaster\Ribbon\EngineReadinessGate.cs` | absent (file did not exist) | **48/48 = 1.000000** | No — new file at 100% |
+| `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | absent (file did not exist) | **72/72 = 1.000000** | No — new file at 100% |
+| `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | absent (file did not exist) | **18/18 = 1.000000** | No — new file at 100% |
+| `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` | absent | absent | No — new file inside the pre-existing `[ExcludeFromCodeCoverage] RibbonController`, excluded by attribute in the final document exactly as the rest of that type already was |
+| `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` | absent | absent | No — new file inside the pre-existing `[ExcludeFromCodeCoverage] RibbonViewer`, likewise excluded |
+| `TaskMaster\Ribbon\RibbonViewer.cs` | absent (type-level `[ExcludeFromCodeCoverage]`) | absent | No — unchanged exclusion status |
+| `TaskMaster\ThisAddIn.cs` | absent (excluded) | absent | No — unchanged exclusion status |
+
+**No changed line lost coverage.** Every line this change added to a measurable file is covered (164 newly-covered lines against 186 newly-valid lines; the 22-line difference is accounted for by measurable lines added elsewhere in the instrumented set, not by any uncovered line in the four new decision types, each of which is at exactly 100%). Every line this change added to a non-measurable file was added to a type that was already `[ExcludeFromCodeCoverage]` at the merge-base, so no file moved from measured to unmeasured.
+
+This is the ratified COM/VSTO/WinForms exemption in CLAUDE.md section UT2 applied to **thin wiring only**: the decision logic is fully covered, and only the null-check-plus-one-delegating-call shims are exempt. That is the distinction the issue #227 precedent requires.
+
+## Testable-denominator caveat (required statement)
+
+The raw repo-wide figure spans vendored and third-party projects — **SVGControl**, **SDILReader**, and **VBFunctions** — and is therefore **NOT** the CLAUDE.md section UT2 testable denominator, which is defined as production-only first-party code after excluding VSTO add-in lifecycle classes, WinForms form-derived and Designer-generated code, and Outlook Interop event-handler classes without an injectable seam.
+
+The merge-base repo-wide figure is recorded and reported here as **pre-existing debt** and is **non-blocking** for this bug fix, per the issue #424 precedent.
+
+## Blocking gates for #503
+
+The blocking coverage gates for this change are, and only are:
+
+1. **Changed-line no-regression** — satisfied, per the per-path table above.
+2. **At-or-above 0.90 line rate for each of the four new types (P6-T7)** — satisfied, all four at 1.000000.
+
+Both are met. The absolute repo-wide figure is a record-and-report obligation, not a floor imposed by this change.
+
+## Documented threshold conflict (recorded, not resolved)
+
+The repository carries two different, mutually inconsistent coverage threshold sets:
+
+| Source | Line threshold | Branch threshold | New-code threshold |
+|---|---|---|---|
+| `CLAUDE.md` section UT2 / `.claude/rules/csharp.md` | >= 80% repo-wide (on the testable denominator) | not specified | >= 90% for any new module/class/method |
+| `.claude/rules/general-unit-test.md` / `.claude/rules/quality-tiers.md` | >= 85% (uniform T1-T4) | >= 75% (uniform T1-T4) | not specified |
+
+This is a **known, unresolved policy conflict**. It is recorded here rather than silently resolved by selecting one number. For the record, the measured post-change repo-wide figures (`line-rate` 0.858516, `branch-rate` 0.792487) clear **both** line thresholds (80% and 85%) and the 75% branch threshold on the raw denominator, and the four new types clear the stricter 90% new-code floor with a 10-point margin. The conflict therefore does not change the outcome for #503, but it remains outstanding for the repository and should be resolved by the maintainer in a separate governance change.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-final.jacoco.xml b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-final.jacoco.xml
new file mode 100644
index 000000000..a08e1f4c9
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-final.jacoco.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="3092" covered="14343" />
+    <counter type="BRANCH" missed="994" covered="3044" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="7529" covered="69213" />
+    <counter type="BRANCH" missed="3131" covered="16105" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="276" covered="2736" />
+    <counter type="BRANCH" missed="119" covered="649" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="1836" covered="1696" />
+    <counter type="BRANCH" missed="654" covered="594" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="1410" covered="2032" />
+    <counter type="BRANCH" missed="460" covered="468" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="106" covered="1374" />
+    <counter type="BRANCH" missed="32" covered="342" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="1464" covered="3515" />
+    <counter type="BRANCH" missed="389" covered="749" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="21" covered="556" />
+    <counter type="BRANCH" missed="16" covered="180" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="8" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md
new file mode 100644
index 000000000..c33105632
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md
@@ -0,0 +1,31 @@
+# Phase 3 QC Step 8 — Canonical Coverage Gate Artifact Regenerated (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T8]
+Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-final.cobertura.xml -Destination artifacts\csharp\coverage.xml`
+EXIT_CODE: 0
+
+## What this artifact is
+
+`artifacts\csharp\coverage.xml` is the canonical **gate** artifact read by `.claude\hooks\validate-feature-review-coverage.ps1`, which expects JaCoCo format. It is regenerated from the P3-T6 coverage run rather than committed: `artifacts/` is gitignored at `.gitignore:57`, confirmed by `git check-ignore -v` reporting `.gitignore:57:artifacts/`. It is local-only and is the single non-evidence exception to the evidence-path rules in plan section 2.1.
+
+## Output Summary
+
+The generated file is 1,534 bytes and carries the same nine first-party packages as the committed feature summary.
+
+| Counter | Covered | Missed | Total | Percentage the hook derives |
+|---|---|---|---|---|
+| LINE | 95478 | 15729 | 111207 | **85.8561%** |
+| BRANCH | 22137 | 5789 | 27926 | **79.2702%** |
+
+### Threshold check
+
+| Threshold | Required | Measured | Verdict |
+|---|---|---|---|
+| Repo-wide LINE (`.claude/rules/general-unit-test.md`, `.claude/rules/quality-tiers.md`) | >= 85 | **85.8561** | **PASS** |
+| Repo-wide BRANCH (same sources) | >= 75 | **79.2702** | **PASS** |
+| Repo-wide line coverage (CLAUDE.md § UT2, `.claude/rules/csharp.md`) | >= 80 | **85.8561** | **PASS** |
+
+Both derived percentages clear every stated floor. The documented conflict between the CLAUDE.md thresholds (80 percent repo-wide, 90 percent new code) and the `.claude/rules/general-unit-test.md` thresholds (85 percent line, 75 percent branch) is recorded in P3-T9 rather than silently resolved here; the measured figures satisfy both sets, so the conflict is not load-bearing for this cycle's verdict.
+
+Binary outcome satisfied: `artifacts\csharp\coverage.xml` exists in JaCoCo format, its derived repo-wide LINE percentage is at or above 85 (85.8561) and BRANCH at or above 75 (79.2702).
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-projection.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-projection.2026-08-08T14-52.md
new file mode 100644
index 000000000..fce210415
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-projection.2026-08-08T14-52.md
@@ -0,0 +1,47 @@
+# Phase 3 QC Step 7 — Final Coverage Projection to First-Party JaCoCo Summary (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T7]
+Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-final.cobertura.xml -Destination docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\qa-gates\coverage-remediation-final.jacoco.xml`
+EXIT_CODE: 0
+
+The script is identical to the one recorded verbatim in `evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md` (P0-T12), including its all-descendant `<line>` counting method, so the baseline and final figures are measured on the same denominator and are directly comparable.
+
+## Output Summary
+
+```text
+PACKAGES=9
+LINE_COVERED=95478
+LINE_MISSED=15729
+BRANCH_COVERED=22137
+BRANCH_MISSED=5789
+LINE_PCT=85.8561
+BRANCH_PCT=79.2702
+PKG QuickFiler LINE 14344/17435 BRANCH 3044/4038
+PKG UtilitiesCS LINE 69217/76742 BRANCH 16111/19236
+PKG TaskVisualization LINE 2736/3012 BRANCH 649/768
+PKG SVGControl LINE 1696/3532 BRANCH 594/1248
+PKG ToDoModel LINE 2032/3442 BRANCH 468/928
+PKG Tags LINE 1374/1480 BRANCH 342/374
+PKG TaskMaster LINE 3515/4979 BRANCH 749/1138
+PKG TaskTree LINE 556/577 BRANCH 180/196
+PKG VBFunctions LINE 8/8 BRANCH 0/0
+```
+
+### Aggregate first-party totals (remediation final)
+
+| Counter | Covered | Missed | Total | Percentage |
+|---|---|---|---|---|
+| LINE | **95478** | **15729** | 111207 | **85.8561%** |
+| BRANCH | **22137** | **5789** | 27926 | **79.2702%** |
+
+The derived `LINE_PCT` of 85.8561 equals the root `<coverage line-rate="0.858561">` attribute of the source Cobertura report exactly, and `BRANCH_PCT` of 79.2702 equals `branch-rate="0.792702"`, confirming the projection is lossless against the report's own aggregate.
+
+The `TaskMaster` package LINE counter is `missed=1464 covered=3515` — unchanged from both the P0-T12 remediation baseline and the implementation-cycle final summary, which is the expected result for a cycle that changes only a test file.
+
+## Artifact checks
+
+- `evidence/qa-gates/coverage-remediation-final.jacoco.xml` exists, is **39 lines** (under the 100-line cap), and contains exactly **9** `<package>` elements.
+- A recursive search for `*.cobertura.xml` anywhere under `<FEATURE>\evidence\` returns **0** matches. The raw 10 MB / 187,000-line reports stay in the gitignored `coverage\` directory.
+
+Binary outcome satisfied on all four conditions.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-remediation-final.jacoco.xml b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-remediation-final.jacoco.xml
new file mode 100644
index 000000000..d0f8e3db5
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-remediation-final.jacoco.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="3091" covered="14344" />
+    <counter type="BRANCH" missed="994" covered="3044" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="7525" covered="69217" />
+    <counter type="BRANCH" missed="3125" covered="16111" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="276" covered="2736" />
+    <counter type="BRANCH" missed="119" covered="649" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="1836" covered="1696" />
+    <counter type="BRANCH" missed="654" covered="594" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="1410" covered="2032" />
+    <counter type="BRANCH" missed="460" covered="468" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="106" covered="1374" />
+    <counter type="BRANCH" missed="32" covered="342" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="1464" covered="3515" />
+    <counter type="BRANCH" missed="389" covered="749" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="21" covered="556" />
+    <counter type="BRANCH" missed="16" covered="180" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="8" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-31.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-31.md
new file mode 100644
index 000000000..8da707e01
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-31.md
@@ -0,0 +1,32 @@
+# CSharpier Repo-Wide Check — Issue #503 (P6-T2)
+
+Timestamp: 2026-08-08T14-46
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: **0**
+
+## Output Summary
+
+```
+Checked 1498 files in 4915ms.
+EXIT_CODE=0
+```
+
+The repository is formatter-clean. The reported unformatted-file set is **empty**.
+
+## Comparison against the P0-T6 merge-base baseline
+
+| Run | Files checked | EXIT_CODE | Unformatted set |
+|---|---|---|---|
+| P0-T6 (merge-base) | 1488 | 0 | empty |
+| P6-T2 (post-change) | 1498 | 0 | empty |
+
+The file count rose by exactly ten, matching the ten new `.cs` files added by this change (six production, four test). Both runs report an empty unformatted set, so the post-change state is no worse than the merge-base by any measure.
+
+Binary outcome: **PASS** via the first branch — `EXIT_CODE: 0`. None of the thirteen scope-locked `.cs` paths from section 4.5 is reported unformatted (nothing is), so no restart at P6-T1 is triggered. This also satisfies the AC22 clause "`csharpier .` reports no formatting changes".
+
+This task is read-only and mutated nothing.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-52.md
new file mode 100644
index 000000000..5123d0b86
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-52.md
@@ -0,0 +1,51 @@
+# Phase 3 QC Step 2 — Repo-Wide CSharpier Check (Read-Only) (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T2]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check ."`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+Checked 1498 files in 3230ms.
+```
+
+- Exit code: **0**.
+- Unformatted set: **empty**.
+- Files checked: 1498, identical to the P0-T8 baseline count.
+
+## Comparison against the P0-T8 baseline
+
+| | P0-T8 baseline | P3-T2 | Match |
+|---|---|---|---|
+| Exit code | 0 | 0 | yes |
+| Files checked | 1498 | 1498 | yes |
+| Unformatted set | empty | **empty** | yes |
+
+The measured set is exactly the P0-T8 set. `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` is **not** reported unformatted, so the phase does not restart at P3-T1.
+
+## First-attempt failure and the restart it caused
+
+The **first** execution of this task returned `EXIT_CODE: 1` with a one-member unformatted set:
+
+```text
+Error .\TaskMaster\Ribbon\RibbonExplorer.xml - Was not formatted.
+  ----------------------------- Expected: Around Line 448 -----------------------------
+          <group id="TriageGroup" imageMso="Filter" label="Triage">
+            <button
+              id="TriageSetA"
+  ----------------------------- Actual: Around Line 448 -----------------------------
+          <group id="TriageGroup" imageMso="Filter" label="Triage">
+            <button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />
+            <button id="TriageSetB" onAction="TriageSetB_Click" getEnabled="EngineCommand_GetEnabled" label="Set B" />
+
+Checked 1498 files in 3581ms.
+EXIT_CODE=1
+```
+
+That set — `{ TaskMaster\Ribbon\RibbonExplorer.xml }` — is not the empty P0-T8 set, so the gate failed. The scope-locked `.cs` file was **not** implicated; the failure was caused by the P2-T1 XML collapse, which CSharpier 1.3.0 rejects because the single-line form is 116 characters against a 100-column print width once the required `getEnabled` attribute is present.
+
+The cause was fixed by reverting the P2-T1 collapse (`git checkout -- TaskMaster/Ribbon/RibbonExplorer.xml`), and Phase 3 restarted from P3-T1. Full measured analysis and the escalation: `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+Binary outcome satisfied: `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-30.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-30.md
new file mode 100644
index 000000000..b270f56d3
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-30.md
@@ -0,0 +1,68 @@
+# CSharpier Format — Issue #503 (P6-T1)
+
+Timestamp: 2026-08-08T14-45
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' format TaskMaster\Ribbon\EngineCommandCatalog.cs TaskMaster\Ribbon\EngineReadinessGate.cs TaskMaster\Ribbon\EngineGatedCommandRunner.cs TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs TaskMaster\Ribbon\RibbonController.EngineCommands.cs TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs TaskMaster\Ribbon\RibbonViewer.cs TaskMaster\ThisAddIn.cs TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+```
+Formatted 13 files in 2621ms.
+EXIT_CODE=0
+```
+
+Exactly the thirteen scope-locked `.cs` paths from plan section 4.5 were passed. `TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` do **not** appear in the argument list, per section 3 rule 5. The mutating pass was never invoked repo-wide. `csharpier pipe-files` was not used.
+
+**This run rewrote nothing.** File-content MD5 values were captured immediately before and immediately after the invocation and are byte-identical for all sixteen touched source paths, proving the format step is idempotent and that this pass begins from a formatter-stable tree.
+
+## Phase 6 restart history (recorded for the P6-T9 single-pass criterion)
+
+The Phase 6 loop was entered three times. Only the third is the recorded clean pass.
+
+| Attempt | P6-T1 outcome | Why the phase restarted |
+|---|---|---|
+| 1 | Rewrote 10 of 13 files | P6-T1 mutated files on disk, so the loop restarted rather than continued. |
+| 2 | Rewrote 0 files, but P6-T5 verification found three nullable diagnostics in authored code | Three minimal source fixes were applied (see below), which is a file change, so the loop restarted. |
+| 3 | **Rewrote 0 files** | None — this is the recorded clean pass. |
+
+### The three source fixes applied between attempt 2 and attempt 3
+
+The P6-T5 command as written (`/t:Build`) reported `EXIT_CODE: 0`, but MSBuild's up-to-date check skips `CoreCompile` when only `/p:` values change, so that result did not prove the new code is nullable-clean. A forced `/t:Rebuild /p:Nullable=enable /p:TreatWarningsAsErrors=true /p:BuildProjectReferences=false` over `TaskMaster.csproj` was therefore run as verification. It surfaced 223 errors, of which exactly **three** originated in code authored by this change:
+
+| File | Diagnostic | Fix |
+|---|---|---|
+| `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | `CS8604` — possible null `controlId` argument to `EngineCommandCatalog.TryGetEngineName` | `BuildNotReadyMessage` now passes the already-non-null `renderedControlId` instead of the raw `controlId`. Behaviour is identical: `"(null)"` is not a catalog key, so it still resolves to `"(unmapped)"`. |
+| `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` | `CS8603` — possible null reference return from `() => Globals?.Engines` | Null-forgiving operator added (`() => Globals?.Engines!`) with a comment recording that a null result is a supported value the gate treats as "not ready". |
+| `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` | `CS8604` — possible null `control?.Id` argument to `IsEngineCommandEnabled` | Null-forgiving operator added (`control?.Id!`) with a comment recording that a null id is a supported input yielding `false`. |
+
+After the fixes the same forced rebuild reports 220 errors and **zero** in any of the six new production files. The residual 220 are pre-existing nullable debt in files this change does not touch (`AppOlObjects.cs` 58, `AppAutoFileObjects.cs` 52, `AppToDoObjects.cs` 48, `AppOlObjects.FolderTreeService.cs` 48, `AppItemEngines.cs` 18, and others), and are recorded in `<FEATURE>\evidence\qa-gates\msbuild-nullable.<TS>.md`.
+
+None of the three fixes changes runtime behaviour; each only records an already-documented nullability contract for the compiler.
+
+## Source-state fingerprint at the start of the recorded clean pass
+
+```
+03e959b34fee6b3c4357148f762a49b9  TaskMaster/Ribbon/EngineCommandCatalog.cs
+cdcb45ca79029ea502105042111baef9  TaskMaster/Ribbon/EngineReadinessGate.cs
+add3305fcb4aab807fe5935493eea6fc  TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+d7ddac56b3474268f1602ced3ad9e4c3  TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+57f643e929497a643f554a2b7699c177  TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+9990f963ac3f09a3d2917bb152fe4b23  TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+388f1680c66443eb9e8697482ba81a1d  TaskMaster/Ribbon/RibbonViewer.cs
+5eb04850a8edb4df30595f3ad374d5b9  TaskMaster/ThisAddIn.cs
+e6081bfcc4a853be11e549024cbbbbe5  TaskMaster/Ribbon/RibbonExplorer.xml
+1751fa6df7979bbc3f7a234c4993c0f5  TaskMaster/TaskMaster.csproj
+fd30be9c1df80560ecfbd099d38a7060  TaskMaster.Test/TaskMaster.Test.csproj
+2eae440dd29f188dccca61dd27896550  TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+c0545768fa69282e50526990428f1a97  TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+25efd8b02f36fc87e5bf78426040a0a1  TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+18c90184f94643ef4bcbb2832be9acd4  TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+9b4c453318e284c445122d4953ac0135  TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+```
+
+These MD5 values are re-verified at P6-T9 to prove no `.cs`, `.csproj`, or `.xml` file changed between P6-T1 and P6-T6.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-52.md
new file mode 100644
index 000000000..41b860836
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-52.md
@@ -0,0 +1,42 @@
+# Phase 3 QC Step 1 — CSharpier Format (Scope-Locked) (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T1]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' format TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs"`
+EXIT_CODE: 0
+
+## Phase 3 restart disclosure
+
+This is the **second** execution of P3-T1. The first Phase 3 attempt was aborted at P3-T2, whose repo-wide `csharpier check .` failed on `TaskMaster\Ribbon\RibbonExplorer.xml`. The cause was the P2-T1 collapse: CSharpier 1.3.0 formats XML and mandates the multi-line form for those three lines once the `getEnabled` attribute pushes them from 78 to 116 characters against a 100-column print width. The collapse was reverted and the phase restarted from P3-T1, per the phase's own loop semantics. Full analysis: `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+The record below is the restarted pass. The tree at the start of this pass contains the F1 fix only; `RibbonExplorer.xml` takes a zero-line diff.
+
+## Output Summary
+
+```text
+Formatted 1 files in 419ms.
+```
+
+**CSharpier did not rewrite the file.** The message reports the number of files *processed*, not the number changed. The content hash is identical on both sides of the invocation:
+
+| Measurement | Before | After | Changed |
+|---|---|---|---|
+| `git hash-object` | `7d422ef399d5be44176acb629a0199bddcf6ff93` | `7d422ef399d5be44176acb629a0199bddcf6ff93` | **no** |
+| Physical line count | 318 | 318 | no |
+
+Because no file changed on disk, the Phase 3 loop does **not** restart from this step. The P1-T1 edit was already CSharpier-conformant as authored.
+
+## Scope-guard compliance
+
+The command was invoked with the explicit scope-locked path list from plan section 4.5 — exactly one `.cs` file:
+
+```text
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs
+```
+
+- **Never invoked repo-wide.** A repo-wide `csharpier format .` would reformat any file unformatted at the merge-base and break the AC15 zero-line-diff requirement. The read-only repo-wide `csharpier check .` gate is run separately at P3-T2.
+- **`TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` did not appear in the argument list.**
+- **`TaskMaster\Ribbon\RibbonExplorer.xml` did not appear in the argument list.** Note that, contrary to plan section 3 rule 6, CSharpier 1.3.0 *does* format XML; the file is nevertheless excluded from the mutating pass because it is outside the scope-locked `.cs` list and is hand-edited.
+- **`csharpier pipe-files` was not used.** It writes to stdout only, never mutates, and would produce a false "stable" result; it is prohibited as a gate.
+
+Binary outcome satisfied: `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csproj-registration-audit.2026-08-08T14-25.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csproj-registration-audit.2026-08-08T14-25.md
new file mode 100644
index 000000000..0c33266ec
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csproj-registration-audit.2026-08-08T14-25.md
@@ -0,0 +1,62 @@
+# csproj `<Compile Include>` Registration Audit — Issue #503 (P5-T9)
+
+Timestamp: 2026-08-08T14-25
+
+Commands (run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55` through `pwsh -NoProfile -File`):
+
+```powershell
+# 1. enumerate the added entries
+Select-String -Path 'TaskMaster\TaskMaster.csproj' -Pattern 'Compile Include="Ribbon\\Engine|Compile Include="Ribbon\\RibbonController.EngineCommands|Compile Include="Ribbon\\RibbonViewer.EngineCommands'
+Select-String -Path 'TaskMaster.Test\TaskMaster.Test.csproj' -Pattern 'Compile Include="Ribbon\\Engine'
+
+# 2. prove every Compile Include in BOTH projects resolves to a file on disk
+foreach ($proj in @('TaskMaster\TaskMaster.csproj','TaskMaster.Test\TaskMaster.Test.csproj')) {
+    $dir = Split-Path -Parent $proj
+    $xml = [xml](Get-Content -Raw -Path $proj)
+    $ns  = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
+    $ns.AddNamespace('m','http://schemas.microsoft.com/developer/msbuild/2003')
+    $nodes = $xml.SelectNodes('//m:Compile[@Include]', $ns)
+    ... Test-Path each Include relative to the project directory ...
+}
+```
+
+EXIT_CODE: 0
+
+## The six entries added to `TaskMaster\TaskMaster.csproj`
+
+```xml
+<Compile Include="Ribbon\EngineCommandCatalog.cs" />
+<Compile Include="Ribbon\EngineCommandRefreshPlanner.cs" />
+<Compile Include="Ribbon\EngineGatedCommandRunner.cs" />
+<Compile Include="Ribbon\EngineReadinessGate.cs" />
+<Compile Include="Ribbon\RibbonController.EngineCommands.cs" />
+<Compile Include="Ribbon\RibbonViewer.EngineCommands.cs" />
+```
+
+Matches plan section 4.6 exactly — same six paths, same spelling.
+
+## The four entries added to `TaskMaster.Test\TaskMaster.Test.csproj`
+
+```xml
+<Compile Include="Ribbon\EngineCommandCatalogTests.cs" />
+<Compile Include="Ribbon\EngineCommandRefreshPlannerTests.cs" />
+<Compile Include="Ribbon\EngineGatedCommandRunnerTests.cs" />
+<Compile Include="Ribbon\EngineReadinessGateTests.cs" />
+```
+
+Matches plan section 4.6 exactly — same four paths, same spelling.
+
+Ten entries total, as required.
+
+## Every `Compile Include` path resolves to an existing file
+
+| Project | `Compile Include` items | Items whose path is missing on disk |
+|---|---|---|
+| `TaskMaster\TaskMaster.csproj` | 48 | **0** |
+| `TaskMaster.Test\TaskMaster.Test.csproj` | 48 | **0** |
+
+Both projects are legacy non-SDK `packages.config` projects with no glob, so a `.cs` file absent from this list would silently fail to compile into the assembly, and conversely an item pointing at a missing file would break the build. Neither condition exists.
+
+Independent corroboration: `git diff --numstat <MERGE_BASE>..HEAD` records `6	0	TaskMaster/TaskMaster.csproj` and `4	0	TaskMaster.Test/TaskMaster.Test.csproj` — six and four added lines respectively, with zero deletions, confirming that only the ten new entries were added and no existing entry was disturbed.
+
+Binary outcome: **PASS**.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md
new file mode 100644
index 000000000..fba6477f6
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md
@@ -0,0 +1,93 @@
+# F2 IS UNSATISFIABLE AS SPECIFIED — CSharpier Formats XML and Mandates the Multi-Line Form
+
+Timestamp: 2026-08-08T14-52
+Discovered at: [P3-T2] (repo-wide `csharpier check .`)
+Status: **F2 NOT REMEDIATED. Escalated to the orchestrator. Not fixed by this executor.**
+
+## What happened
+
+P2-T1 collapsed the three `TriageSet*` `<button>` elements to single-line form exactly as pinned in plan section 5.2. Every Phase 2 gate passed on its own terms: 524 lines (P2-T2), well-formed CustomUI (P2-T3), `EMBEDDED_TRIAGESETA_SINGLELINE=True` (P2-T4), 8/8 ribbon-XML tests green (P2-T5).
+
+The **repo-wide formatting gate at P3-T2 then failed**:
+
+```text
+Error .\TaskMaster\Ribbon\RibbonExplorer.xml - Was not formatted.
+  ----------------------------- Expected: Around Line 448 -----------------------------
+          <group id="TriageGroup" imageMso="Filter" label="Triage">
+            <button
+              id="TriageSetA"
+  ----------------------------- Actual: Around Line 448 -----------------------------
+          <group id="TriageGroup" imageMso="Filter" label="Triage">
+            <button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />
+            <button id="TriageSetB" onAction="TriageSetB_Click" getEnabled="EngineCommand_GetEnabled" label="Set B" />
+
+Checked 1498 files in 3581ms.
+EXIT_CODE=1
+```
+
+CSharpier's **Expected** output is the six-line form. The formatter is demanding precisely the layout F2 asked to remove.
+
+## Root cause — measured, not inferred
+
+Plan section 3 rule 6 asserts "CSharpier does not format XML." **That assertion is false for this toolchain.** Measurements:
+
+| Fact | Measurement |
+|---|---|
+| CSharpier version | **1.3.0** — the 1.x line formats XML, not only C# |
+| `.csharpierignore` contents | excludes `**/evidence/**`, `*.cobertura.xml`, `*.coverage`, `*.coveragexml`, `*.trx`, `*.csproj`, `*.props`, `*.targets`. **`*.xml` in general, and `RibbonExplorer.xml` in particular, are NOT excluded** |
+| CSharpier default print width | 100 columns (no `.csharpierrc` present; no `max_line_length` in `.editorconfig`) |
+| Merge-base single-line form, `<button id="TriageSetA" onAction="TriageSetA_Click" label="Set A" />` | **78 characters** — fits within 100, so single-line was formatter-clean |
+| Single-line form **with** the added attribute | **116 characters** — exceeds 100, so CSharpier mandates the multi-line form |
+
+The arithmetic is decisive. Adding `getEnabled="EngineCommand_GetEnabled"` (37 characters including the trailing space) to a 78-character line yields 115-116 characters. There is no attribute ordering, and no permitted alternative callback name (AC5, AC6, and AC8 pin the value `EngineCommand_GetEnabled`), that brings the line under 100.
+
+## Consequence — the F2 finding rests on a factual error
+
+`remediation-inputs.2026-08-08T14-26.md` §F2 states that "approximately 12 lines came from reformatting three previously single-line `<button>` elements into multi-line form, which is **incidental churn with no functional purpose**", and `code-review.2026-08-08T14-15.md` states that "12 of those lines buy nothing."
+
+Both statements are incorrect. Those 12 lines are **mandated by the repository's own formatter** once the functionally required attribute is added. The implementation cycle did not gratuitously reformat those elements; it produced the only layout that passes `csharpier check .`.
+
+F2's required outcome — "restore the three reformatted `<button>` elements to their original single-line form **while retaining their `getEnabled` attribute**" — is therefore **mechanically unsatisfiable** while the mandatory format gate must pass. Its acceptance gate of "line count at or below 527" is likewise unreachable: 539 is the formatter-mandated minimum for a file carrying all eight attributes.
+
+## Action taken
+
+The P2-T1 collapse was **reverted** with `git checkout -- TaskMaster/Ribbon/RibbonExplorer.xml`, restoring the formatter-mandated 539-line form. Re-running the gate confirms the tree is clean:
+
+```text
+Checked 1498 files in 3682ms.
+EXIT_CODE=0
+```
+
+Phase 3 restarts from P3-T1 per its own loop semantics ("If any task fails ... fix the cause and restart the phase from P3-T1"). The cause was the P2-T1 edit; reverting it is the fix that restores gate compliance.
+
+## Why the alternative fixes were rejected
+
+| Candidate fix | Rejected because |
+|---|---|
+| Add `*.xml` or `RibbonExplorer.xml` to `.csharpierignore` | `.csharpierignore` is not in the plan's section 4 scope lock. It is also a **gate-weakening change**: suppressing a formatter check so a change can pass is the pattern `.claude/rules/csharp.md` Prohibited Behaviors forbids. It would additionally un-format every other XML file in the repository. |
+| Raise CSharpier's print width via a new `.csharpierrc` | Out of scope, and would reformat the entire repository, breaking the AC15 zero-line-diff guarantee on the three protected paths. |
+| Keep the collapse and accept a red format gate | Violates CLAUDE.md CUT3 and `.claude/rules/csharp.md`, which require the format step to pass, and fails P3-T2's and P3-T12's own binary outcomes. |
+| Shorten the line some other way | Impossible. The callback value is pinned by AC5/AC6/AC8; the control ids are pinned by `EngineCommandCatalog`. |
+
+Per the executor directive, a newly discovered defect is **recorded for the orchestrator to promote, not fixed**. No `.csharpierignore`, `.csharpierrc`, or formatter configuration was modified.
+
+## Superseded Phase 2 evidence
+
+These artifacts record real measurements taken while the collapse was present. They remain valid as the record of the attempt and are the proof of the conflict, but they no longer describe the tree:
+
+- `evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md` — recorded 524 lines. The tree is now **539**.
+- `evidence/other/phase2-build.2026-08-08T14-52.md` — recorded `EMBEDDED_TRIAGESETA_SINGLELINE=True`. It is now **False** again.
+- `evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md` and `evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md` — their conclusions (well-formed CustomUI; AC5/AC6/AC7/AC8 green) hold for the reverted tree as well, and were re-confirmed by the Phase 3 restart, but they were measured against the collapsed form.
+
+Plan tasks P2-T1 through P2-T5 are un-checked in the plan file, because the outcome they certify is not present in the tree.
+
+## Recommendation for the orchestrator
+
+1. Close F2 as **not remediable as specified**, citing the print-width arithmetic above.
+2. If the 500-line overage on `RibbonExplorer.xml` is to be addressed at all, the only viable route is **splitting the resource** into multiple embedded files — a separate, larger change that `spec.md` AC25 already declines and that should be its own issue.
+3. Correct plan section 3 rule 6 ("CSharpier does not format XML") in any future plan; it is false for CSharpier 1.3.0 and caused this cycle to pin an unsatisfiable edit.
+4. Note that F1 — the substantive finding, and the one the code review called "the most substantive" — **is fully remediated and proven** by the recorded mutate-build-fail-restore cycle.
+
+## Net effect on the repository
+
+`TaskMaster\Ribbon\RibbonExplorer.xml` takes a **zero-line diff** from this remediation cycle. The only source change this cycle contributes is the F1 fix in `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md
new file mode 100644
index 000000000..2ff69b5ba
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md
@@ -0,0 +1,41 @@
+# F2 — Ribbon XML Size and Attribute Gates (Cycle 1, Issue #503)
+
+> **SUPERSEDED — this measurement no longer describes the tree.** The P2-T1 collapse that produced the 524-line figure below was **reverted** at [P3-T2] because CSharpier 1.3.0 formats XML and mandates the multi-line form for these three lines once the `getEnabled` attribute is added (116 characters against a 100-column print width). `RibbonExplorer.xml` is back at **539** lines and takes a zero-line diff from this cycle. See `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md` for the measured root cause and the escalation. The record below is retained as the evidence of the attempt.
+
+Timestamp: 2026-08-08T14-52
+Task: [P2-T2]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; (Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' | Measure-Object -Line).Lines; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=\"EngineCommand_GetEnabled\"' -AllMatches | Measure-Object).Count"`
+EXIT_CODE: 0
+
+Corroborating command: `wc -l TaskMaster/Ribbon/RibbonExplorer.xml`
+
+## Output Summary
+
+```text
+524
+8
+```
+
+`wc -l` independently reports **524**. The file contains no blank lines, so both counting methods agree.
+
+### Line count against every reference point
+
+| Reference point | Lines | Relation to the measured 524 |
+|---|---|---|
+| Merge-base `003c5715` (pre-feature) | 519 | +5 |
+| Post-implementation-cycle (pre-remediation) | 539 | **-15** |
+| **Measured post-F2** | **524** | — |
+| F2 gate ceiling (519 merge-base + 8 functional attribute lines) | 527 | **3 lines under** |
+| Repository 500-line cap | 500 | +24 (pre-existing overage; see below) |
+
+The file is **at or below the 527 gate** and is **strictly below** its 539-line pre-remediation count, satisfying both conditions the F2 finding binds.
+
+The residual +5 against the merge-base is the functional cost of the fix that survives the collapse: five of the eight engine-backed buttons (`TrainSpam`, `TrainHam`, `TestSpam`, `FilterTriageGroup`, `ClearTriage`) were **already** multi-line at the merge-base, so adding a `getEnabled` attribute to each added one line apiece. The three `TriageSet*` buttons were single-line at the merge-base and are single-line again, so they now cost zero added lines rather than the six each they cost before this remediation.
+
+The 24-line overage against the repository 500-line cap is the **pre-existing** condition recorded as an accepted exception by `spec.md` AC25 (which quotes 519 as the accepted figure) and is not remediated here. `.claude/rules/general-code-change.md` applies the cap to production, test, and reusable script files; `RibbonExplorer.xml` is a declarative embedded UI resource. This cycle reduces the overage from 39 lines to 24; it does not eliminate it, and eliminating it would require splitting the resource, which is a separate and larger change.
+
+### Attribute count
+
+**8** occurrences of `getEnabled="EngineCommand_GetEnabled"`, unchanged from the pre-remediation count and from the merge-base-plus-fix expectation. All eight engine-backed controls (`TrainSpam`, `TrainHam`, `TestSpam`, `TriageSetA`, `TriageSetB`, `TriageSetC`, `FilterTriageGroup`, `ClearTriage`) retain the callback. The collapse changed layout only; it removed no attribute.
+
+Binary outcome satisfied: the file is at or below 527 lines (measured **524**) and contains exactly **8** occurrences.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md
new file mode 100644
index 000000000..0edc4090f
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md
@@ -0,0 +1,25 @@
+# F2 — Ribbon XML Well-Formedness and Namespace (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P2-T3]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; [xml]$d = Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' -Raw; $d.DocumentElement.LocalName; $d.DocumentElement.NamespaceURI"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+customUI
+http://schemas.microsoft.com/office/2009/07/customui
+```
+
+| Property | Value | Required |
+|---|---|---|
+| Parse result | **no error** — the `[xml]` cast succeeded, so the document is well-formed | no error |
+| Root local name | **`customUI`** | `customUI` |
+| Root namespace URI | **`http://schemas.microsoft.com/office/2009/07/customui`** | `http://schemas.microsoft.com/office/2009/07/customui` |
+
+The `[xml]` type accelerator invokes `XmlDocument.LoadXml`, which throws `XmlException` on malformed content. It did not throw, so the collapse of the three `<button>` elements introduced no unbalanced tag, unescaped character, or malformed attribute.
+
+The namespace is the 2009 (`customUI14`) namespace, which is what the ribbon-XML tests assert against namespace-aware. It is unchanged by the F2 edit, which touched only the internal layout of three self-closing `<button>` elements and no namespace declaration.
+
+Binary outcome satisfied: the document parses without error, the root local name is `customUI`, and the namespace URI is `http://schemas.microsoft.com/office/2009/07/customui`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-33.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-33.md
new file mode 100644
index 000000000..3dd20f1cf
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-33.md
@@ -0,0 +1,68 @@
+# AC25 Post-Format 500-Line Audit — Issue #503 (P6-T3)
+
+Timestamp: 2026-08-08T14-47
+
+This is the **authoritative** file-size audit, measured after the P6-T1 CSharpier format pass. It supersedes the advisory P0-T11 counts.
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD | ForEach-Object { if (Test-Path $_) { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines } }"
+```
+
+Corroborating command (physical line counts, the stricter measure — `Measure-Object -Line` does not count blank lines, as recorded in the P0-T11 measurement-method note):
+```
+git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD | while read f; do [ -f "$f" ] && wc -l < "$f"; done
+```
+
+EXIT_CODE: 0
+
+## Output Summary — source files in the branch diff
+
+| Path | `Measure-Object -Line` | Physical lines (`wc -l`) | <= 500? |
+|---|---|---|---|
+| `TaskMaster/Ribbon/EngineCommandCatalog.cs` | 83 | **88** | Yes |
+| `TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs` | 56 | **58** | Yes |
+| `TaskMaster/Ribbon/EngineGatedCommandRunner.cs` | 129 | **139** | Yes |
+| `TaskMaster/Ribbon/EngineReadinessGate.cs` | 95 | **103** | Yes |
+| `TaskMaster/Ribbon/RibbonController.EngineCommands.cs` | 94 | **100** | Yes |
+| `TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs` | 168 | **207** | Yes |
+| `TaskMaster/Ribbon/RibbonViewer.cs` | 299 | **388** | Yes |
+| `TaskMaster/ThisAddIn.cs` | 271 | **307** | Yes |
+| `TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs` | 103 | **116** | Yes |
+| `TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs` | 47 | **52** | Yes |
+| `TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs` | 306 | **346** | Yes |
+| `TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs` | 189 | **223** | Yes |
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | 279 | **309** | Yes |
+| `TaskMaster/Ribbon/RibbonExplorer.xml` | 539 | **539** | No — accepted pre-existing exception, see below |
+| `TaskMaster/TaskMaster.csproj` | 579 | **581** | No — accepted pre-existing exception, see below |
+| `TaskMaster.Test/TaskMaster.Test.csproj` | 380 | **380** | Yes |
+
+**Every `.cs` path is at or under 500 lines by both measures.** The largest is `TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs` at 346 physical lines, a 154-line margin under the cap.
+
+### `TaskMaster/Ribbon/RibbonViewer.cs` is below its merge-base count
+
+Merge-base: **487** physical lines. Post-change: **388** physical lines, a reduction of 99. This is the P3-T1 / P3-T4 partial-class split (one line added for `partial`, 100 lines removed by relocating the `#region Spam Manager` and `#region Triage` blocks), which is exactly what AC25 requires and what created the headroom for the new callbacks.
+
+### Accepted pre-existing exceptions (not violations)
+
+| Path | Merge-base | Post-change | Rationale |
+|---|---|---|---|
+| `TaskMaster/Ribbon/RibbonExplorer.xml` | 519 | 539 | Declarative embedded UI resource, not production/test/script code. The overage **predates #503** (519 > 500 at the merge-base). The plan section 4.2 and spec Correction Log entry 5 record this as an accepted pre-existing exception rather than something remediated here; splitting the ribbon into multiple embedded resources is a separate, larger change to `RibbonViewer.GetCustomUI`. |
+| `TaskMaster/TaskMaster.csproj` | 575 | 581 | Declarative MSBuild project file, not production/test/script code. The overage **predates #503** (575 > 500 at the merge-base). The change adds exactly the six mandated `<Compile Include>` entries; a legacy non-SDK `packages.config` project cannot use globs, so the entries are unavoidable. |
+
+Both are declarative build/UI descriptors rather than code files, and both were already over 500 lines at the merge-base, so neither is an overage introduced by this change.
+
+### Documentation and evidence paths in the diff
+
+Every remaining path in the diff lies under `docs/features/` or `.claude/agent-memory/`. These are documentation and evidence, are expected diff entries, and are **not** source-scope violations. Markdown documentation files are explicitly exempt from the 500-line cap per the file-size exceptions in `.claude/rules/general-code-change.md`. Their counts are recorded for the audit trail:
+
+- Largest Markdown: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md` at 509 physical lines — exempt as Markdown documentation, recorded not treated as a violation.
+- `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md` at 446, `plan.2026-08-08T11-59.md` at 378 — both under 500 in any case.
+- `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/coverage-baseline.cobertura.xml` at 187,114 lines — a tool-generated Cobertura coverage evidence artifact, not production/test/script code, and required by AC24 as the baseline half of the coverage comparison.
+- All `.claude/agent-memory/` files are Markdown, the largest at 86 lines.
+
+## Scope statement
+
+Every path that appears in the audit is either a member of the plan's section 4 scope lock, or lies under `docs/features/` or `.claude/agent-memory/`. No `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears.
+
+Binary outcome: **PASS** — no `.cs` file exceeds 500 lines, so no restart at P6-T1 is triggered.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-52.md
new file mode 100644
index 000000000..a6d6a414f
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-52.md
@@ -0,0 +1,80 @@
+# Phase 3 QC Step 3 — Post-Format File-Size Audit (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T3]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git status --porcelain | ForEach-Object { $_.Substring(3) } | ForEach-Object { if (Test-Path $_) { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines } }"`
+EXIT_CODE: 0
+
+Corroborating command: `wc -l TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs TaskMaster/Ribbon/RibbonExplorer.xml`
+
+## The only source path in the change set
+
+| Path | `Measure-Object -Line` | Physical (`wc -l`) | 500-line cap | Verdict |
+|---|---|---|---|---|
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | 288 | **318** | 500 | **PASS** — 182 lines of headroom |
+
+This is the **only** `.cs`, `.csproj`, `.xml`, or `.sln` path present in the working-tree change set. The binding figure is the physical count of **318**, per the measurement-method reconciliation recorded in `evidence/remediation-baseline/file-line-counts.2026-08-08T14-52.md`: `Measure-Object -Line` contributes zero for an empty string and therefore under-reports a `.cs` file by its blank-line count (30 here).
+
+## `TaskMaster\Ribbon\RibbonExplorer.xml` — recorded explicitly
+
+The task text requires this path be recorded against both the 519-line merge-base figure accepted by AC25 and the 527-line gate for this cycle.
+
+| Reference | Lines |
+|---|---|
+| Merge-base `003c5715` (the figure AC25 accepts as a pre-existing exception) | 519 |
+| Post-implementation-cycle | 539 |
+| F2 gate ceiling for this cycle | 527 |
+| **Measured now** | **539** |
+
+The path **does not appear in the change set** because it takes a **zero-line diff** from this remediation cycle. The P2-T1 collapse that would have brought it to 524 was reverted at [P3-T2]: CSharpier 1.3.0 formats XML and mandates the multi-line form once the required `getEnabled` attribute pushes those lines from 78 to 116 characters against a 100-column print width, so the F2 target of 527 or below is unreachable while the mandatory format gate must pass. The measured root cause and the escalation are in `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+The file therefore **remains at 539 lines and above the 527 gate**. This is recorded as an unmet F2 objective, escalated to the orchestrator, and explicitly **not** reported as a pass. It is not a regression introduced by this cycle: 539 is the state this cycle inherited and the state it leaves.
+
+## Exemptions applied
+
+Per `.claude/rules/general-code-change.md`, the 500-line cap applies to production code, test code, and reusable script files. Markdown documentation files are exempt. Every other entry in the change set is a Markdown documentation, evidence, or agent-memory file under `docs/features/` or `.claude/agent-memory/` and is exempt on that basis. The largest is `remediation-plan.2026-08-08T14-26.md` at 245 counted lines (331 physical) — a Markdown plan document, exempt.
+
+Full change-set listing:
+
+```text
+.claude/agent-memory/atomic-executor/MEMORY.md=82
+.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md=14
+.claude/agent-memory/atomic-planner/MEMORY.md=45
+.claude/agent-memory/feature-review/MEMORY.md=57
+.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md=9
+TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs=288
+.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md=14
+.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md=14
+.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md=14
+.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md=14
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md=33
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-postrestore.2026-08-08T14-52.md=33
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-premutation.2026-08-08T14-52.md=30
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T14-52.md=34
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-52.md=37
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-52.md=28
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md=63
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md=27
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md=18
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md=65
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md=48
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md=30
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md=29
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md=37
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md=22
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md=36
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md=37
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/=0
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md=73
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md=167
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md=32
+docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md=245
+docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md=57
+```
+
+Note on one benign diagnostic: `git status --porcelain` collapses the wholly-untracked `evidence/remediation-baseline/` into a single directory entry, so `Get-Content` emitted `Unable to get content because it is a directory` for it and the loop recorded `=0`. This is a property of the porcelain's directory collapsing, not a missing or empty file; the directory holds ten evidence artifacts, all Markdown or JaCoCo XML and all exempt from the cap.
+
+## Binary outcome
+
+- **Every `.cs` path is at or under 500 lines** — satisfied: the single `.cs` path is at 318.
+- **`TaskMaster\Ribbon\RibbonExplorer.xml` at or under 527 and strictly below 539** — **NOT satisfied.** The file is at 539. Recorded here as an unmet F2 objective with its measured cause, rather than reported as a pass. See `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/lambda-deferral-audit.2026-08-08T14-18.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/lambda-deferral-audit.2026-08-08T14-18.md
new file mode 100644
index 000000000..546895497
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/lambda-deferral-audit.2026-08-08T14-18.md
@@ -0,0 +1,75 @@
+# AC10 Lambda-Deferral Audit — Issue #503 (P5-T6)
+
+Timestamp: 2026-08-08T14-18
+
+Command (extracts every `RunEngineCommandAsync` invocation with its full argument list from the rewritten handlers):
+```
+awk '/RunEngineCommandAsync\(/{p=1} p{print NR": "$0} /^\s*\);\s*$/{if(p){p=0; print "---"}}' TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+```
+
+EXIT_CODE: 0
+
+## Output Summary — the eight rewritten handler bodies, verbatim
+
+| # | Handler | Control id argument | `Func<Task>` lambda body | Engine dereference inside the lambda only? |
+|---|---|---|---|---|
+| 1 | `TrainSpam_Click` | `"TrainSpam"` | `() => Controller.SB.TrainAsync(Controller.OlSelection, true)` | **Yes** — `Controller.SB` is inside the lambda |
+| 2 | `TrainHam_Click` | `"TrainHam"` | `() => Controller.SB.TrainAsync(Controller.OlSelection, false)` | **Yes** |
+| 3 | `TestSpam_Click` | `"TestSpam"` | `() => ((SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine).TestAsync(Controller.OlSelection)` | **Yes** — the `InboxEngines[...]` indexer is inside the lambda |
+| 4 | `TriageSetA_Click` | `"TriageSetA"` | `() => _controller.Triage.OlLogic.TrainSelectionAsync("A")` | **Yes** — `_controller.Triage` is inside the lambda |
+| 5 | `TriageSetB_Click` | `"TriageSetB"` | `() => _controller.Triage.OlLogic.TrainSelectionAsync("B")` | **Yes** |
+| 6 | `TriageSetC_Click` | `"TriageSetC"` | `() => _controller.Triage.OlLogic.TrainSelectionAsync("C")` | **Yes** |
+| 7 | `ClearTriage_Click` | `"ClearTriage"` | `() => _controller.Triage.OlLogic.UnTrainSelectionAsync()` | **Yes** |
+| 8 | `FilterViewer_Click` | `"FilterTriageGroup"` | `() => _controller.Triage.OlLogic.FilterViewAsync()` | **Yes** |
+
+Verbatim extraction:
+
+```
+84:             await Controller.RunEngineCommandAsync(
+85:                 "TrainSpam",
+86:                 () => Controller.SB.TrainAsync(Controller.OlSelection, true)
+87:             );
+90:             await Controller.RunEngineCommandAsync(
+91:                 "TrainHam",
+92:                 () => Controller.SB.TrainAsync(Controller.OlSelection, false)
+93:             );
+96:             await Controller.RunEngineCommandAsync(
+97:                 "TestSpam",
+98:                 () =>
+99:                     (
+100:                         (SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine
+101:                     ).TestAsync(Controller.OlSelection)
+102:             );
+142:             await Controller.RunEngineCommandAsync(
+143:                 "TriageSetA",
+144:                 () => _controller.Triage.OlLogic.TrainSelectionAsync("A")
+145:             );
+148:             await Controller.RunEngineCommandAsync(
+149:                 "TriageSetB",
+150:                 () => _controller.Triage.OlLogic.TrainSelectionAsync("B")
+151:             );
+154:             await Controller.RunEngineCommandAsync(
+155:                 "TriageSetC",
+156:                 () => _controller.Triage.OlLogic.TrainSelectionAsync("C")
+157:             );
+164:             await Controller.RunEngineCommandAsync(
+165:                 "ClearTriage",
+166:                 () => _controller.Triage.OlLogic.UnTrainSelectionAsync()
+167:             );
+176:             await Controller.RunEngineCommandAsync(
+177:                 "FilterTriageGroup",
+178:                 () => _controller.Triage.OlLogic.FilterViewAsync()
+179:             );
+```
+
+## Assessment
+
+Each of the eight handlers passes exactly two arguments to `RunEngineCommandAsync`: a **string literal** control id and a **lambda**. In every case the only argument evaluated before `RunEngineCommandAsync` is entered is the string literal. `Controller` is a plain field-backed property read that touches no engine. No engine dereference — `Controller.SB`, `_controller.Triage`, or `Controller.Engines.InboxEngines[...]` — appears anywhere except inside a lambda body.
+
+Consequence: when `IsCommandEnabled(controlId)` is false, `EngineGatedCommandRunner.RunAsync` returns `Task.CompletedTask` without ever invoking the lambda, so no engine is dereferenced. That is exactly what converts the `NullReferenceException` (handlers 1, 2, 4-8) and the `KeyNotFoundException` (handler 3) into a no-op.
+
+`FilterViewer_Click` correctly uses control id `FilterTriageGroup`, matching the ribbon XML element id rather than the handler name.
+
+Corroborating runtime evidence: `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` and `RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException` both assert that the supplied lambda is never entered when the gate is closed (recorded in `<FEATURE>\evidence\regression-testing\pass-after-503.2026-08-08T13-32.md`).
+
+Binary outcome: **PASS**.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/manual-only-unchecked.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/manual-only-unchecked.2026-08-08T14-52.md
new file mode 100644
index 000000000..64f3c47aa
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/manual-only-unchecked.2026-08-08T14-52.md
@@ -0,0 +1,40 @@
+# Phase 4 — MANUAL-ONLY Criteria Remain Unchecked (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P4-T2]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Select-String -Path 'docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md' -Pattern '\*\*AC19|\*\*AC20|\*\*AC21'"`
+EXIT_CODE: 0
+
+## Output Summary
+
+The three criterion lines, quoted verbatim (truncated at 120 characters for readability; the leading checkbox marker is the material part and is shown in full):
+
+```text
+- [ ] **AC19 (R5b, A3) — MANUAL-ONLY.** In a live Outlook Explorer, immediately after add-in reload and before initializ...
+- [ ] **AC20 (R5b, A2, A3) — MANUAL-ONLY.** In the same live session, after `InitAsync()` completes, each of the eight c...
+- [ ] **AC21 (R5c, A4) — MANUAL-ONLY.** In a live Outlook session, Office visually greys the eight buttons during initia...
+```
+
+A fourth match is the prose line under `## Delivery Notes and Deviations`, which is not a criterion:
+
+```text
+**AC19, AC20, and AC21 remain unchecked by design.** They are MANUAL-ONLY and require a live Outlook profile. The mainta...
+```
+
+| Criterion | Marker | Required |
+|---|---|---|
+| AC19 | `- [ ] **AC19` | `- [ ] **AC19` |
+| AC20 | `- [ ] **AC20` | `- [ ] **AC20` |
+| AC21 | `- [ ] **AC21` | `- [ ] **AC21` |
+
+All three still begin `- [ ]`. **None was checked off in this cycle.**
+
+Per plan section 3 rule 11 and the criteria's own text, these must never be checked off on the strength of unit tests, source inspection, or any automated artifact produced by this cycle. They require recorded live-Outlook verification against a running Outlook process and a live mail profile, which `.claude/rules/general-unit-test.md` forbids automated tests from depending on. The maintainer checklist at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` carries `Status: PENDING MAINTAINER EXECUTION` and is unchanged by this cycle.
+
+## No acceptance criterion changed state in this cycle
+
+Beyond the three MANUAL-ONLY criteria, `git diff -U0 -- .../spec.md | grep -E '^[+-].*- \[[ x]\]'` returns **no match**, confirming that **no** `- [ ]` or `- [x]` marker anywhere in `spec.md` changed state. The only `spec.md` edit is the append-only P4-T1 subsection: `git diff --numstat` reports `12  0` — twelve lines added, **zero deleted**.
+
+The `- [ ] Blocker` / `- [x] High` / `- [ ] Medium` / `- [ ] Low` markers under `## Impact / Severity` are severity markers, not acceptance criteria, and are likewise unmodified.
+
+Binary outcome satisfied: all three lines still begin `- [ ] **AC19`, `- [ ] **AC20`, and `- [ ] **AC21`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-35.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-35.md
new file mode 100644
index 000000000..ed7b294d6
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-35.md
@@ -0,0 +1,42 @@
+# MSBuild Analyzer Gate — Issue #503 (P6-T4)
+
+Timestamp: 2026-08-08T14-35
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: **0**
+
+## Output Summary
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **6**
+
+### Reconciliation against the P0-T7 merge-base baseline
+
+| Diagnostic | Baseline (P0-T7) | Now (P6-T4) | New? |
+|---|---|---|---|
+| `System.Reactive.PackagesConfigCheck.targets(31,5): warning : ... packages.config ... not supported by System.Reactive v7.0` | 5 (`QuickFiler`, `TaskMaster`, `ToDoModel`, `UtilitiesCS`, `UtilitiesCS.Test`) | 5 (same five projects) | No — pre-existing, unchanged |
+| `CSC : warning CS2002: Source file '...\UtilitiesCS.Test\OutlookObjects\Folder\PercentageFormatterTests.cs' specified multiple times [UtilitiesCS.Test.csproj]` | 0 (build was incrementally up to date and skipped `CoreCompile` for `UtilitiesCS.Test`) | 1 | No — **pre-existing and out of scope**, established in `<FEATURE>\evidence\other\phase2-build.2026-08-08T13-30.md` |
+
+`CS2002` originates from a duplicate `<Compile Include>` item that already exists at the merge-base (`git show <MERGE_BASE>:UtilitiesCS.Test/UtilitiesCS.Test.csproj | grep -c PercentageFormatterTests.cs` returns 2), in a project this branch has not touched (`git diff --name-only <MERGE_BASE>..HEAD -- UtilitiesCS.Test/` returns 0 paths). It is outside the plan's section 4 scope lock and is therefore recorded rather than fixed.
+
+### Analyzer rule diagnostics
+
+A scan of the full build log for analyzer rule IDs returns exactly two occurrences, both the same `CS2002` compiler warning (emitted once in the per-project block and once in the summary block). There are **zero** occurrences of any of the following across the entire log:
+
+- `CA####` (.NET analyzers)
+- `S####` (SonarAnalyzer.CSharp)
+- `MA####` (Meziantou.Analyzer)
+- `RCS####` (Roslynator.Analyzers)
+- `AsyncFixer##` (AsyncFixer)
+- `RS0030` (BannedApiAnalyzers banned-symbol rule)
+
+The absence of `RS0030` is the `BannedSymbols.txt` result referenced by AC28: no new or changed file in this branch calls `DateTime.Now`, `DateTime.UtcNow`, `Random.Shared`, `Thread.Sleep`, or `Task.Delay`.
+
+Binary outcome: **PASS** — zero errors and no new analyzer diagnostic relative to the P0-T7 baseline. This satisfies the AC22 clause "completes with zero errors and no new analyzer diagnostics".
+
+This task mutated no source file.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md
new file mode 100644
index 000000000..9549e7c93
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md
@@ -0,0 +1,36 @@
+# Phase 3 QC Step 4 — Analyzer Gate (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T4]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+    0 Error(s)
+    6 Warning(s)
+```
+
+- **Errors: 0.**
+- **Warnings: 6** — identical in count and in membership to the P0-T9 baseline.
+
+### Diagnostic-by-diagnostic comparison against the P0-T9 baseline
+
+| Diagnostic | Project | P0-T9 baseline | P3-T4 | New? |
+|---|---|---|---|---|
+| `System.Reactive.PackagesConfigCheck.targets(31,5): warning : The project contains a packages.config file...` | `QuickFiler.csproj` | present | present | no |
+| same | `TaskMaster.csproj` | present | present | no |
+| same | `ToDoModel.csproj` | present | present | no |
+| same | `UtilitiesCS.csproj` | present | present | no |
+| same | `UtilitiesCS.Test.csproj` | present | present | no |
+| `CSC : warning CS2002: Source file '...\UtilitiesCS.Test\OutlookObjects\Folder\PercentageFormatterTests.cs' specified multiple times` | `UtilitiesCS.Test.csproj` | present | present | no |
+
+**No diagnostic is present that was absent from the P0-T9 baseline.** Both diagnostics are pre-existing and untouched by this cycle:
+
+- `CS2002` is the duplicate `<Compile Include>` entry routed to issue **#510**, explicitly out of scope and not fixed here.
+- The `System.Reactive` packages.config advisory is a build-infrastructure notice unrelated to this change.
+
+The one file this cycle modifies, `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, produced **no** analyzer diagnostic. The BannedApiAnalyzers stage runs as part of this build and reported nothing against the change.
+
+Binary outcome satisfied: `EXIT_CODE: 0` with no diagnostic absent from the P0-T9 baseline.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-49.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-49.md
new file mode 100644
index 000000000..d7e5a5b7d
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-49.md
@@ -0,0 +1,80 @@
+# MSBuild Nullable / Type-Check Gate — Issue #503 (P6-T5)
+
+Timestamp: 2026-08-08T14-49
+
+Command (exactly as specified by P6-T5):
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: **0**
+
+## Output Summary
+
+- Result: `Build succeeded.`
+- Error count: **0**
+- Warning count: **5** (the pre-existing System.Reactive `packages.config` notices recorded in the P0-T8 baseline; they are emitted by an MSBuild `.targets` file rather than the compiler, so `/p:TreatWarningsAsErrors=true` does not promote them)
+- Zero `CS86xx` nullable-flow diagnostics
+- Elapsed: 00:00:01.81
+
+Baseline comparison: the P0-T8 merge-base run of the same command reported `Build succeeded.`, 0 errors, 5 warnings, 00:00:01.65. The gate result is unchanged by this work.
+
+## Supplementary verification — forced recompile
+
+MSBuild's up-to-date check does not re-run `CoreCompile` when only `/p:` values change, so the `/t:Build` form above can report success without actually type-checking under `Nullable=enable`. To confirm the criterion holds substantively rather than vacuously, a forced recompile of the two projects this change touches was run as verification (not as a substitute for the P6-T5 command, which was executed and recorded above):
+
+```
+MSBuild.exe TaskMaster\TaskMaster.csproj      /t:Rebuild /p:Configuration=Debug /p:Platform='AnyCPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true /p:BuildProjectReferences=false
+MSBuild.exe TaskMaster.Test\TaskMaster.Test.csproj /t:Rebuild /p:Configuration=Debug /p:Platform='AnyCPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true /p:BuildProjectReferences=false
+```
+
+### Result of the forced recompile
+
+| Measure | Before the three fixes | After the three fixes |
+|---|---|---|
+| Total errors in `TaskMaster.csproj` | 223 | **220** |
+| Errors originating in the six new/changed files of this change | **3** | **0** |
+
+**All six new production files are nullable-clean** under `/p:Nullable=enable /p:TreatWarningsAsErrors=true`:
+
+- `TaskMaster\Ribbon\EngineCommandCatalog.cs`
+- `TaskMaster\Ribbon\EngineReadinessGate.cs`
+- `TaskMaster\Ribbon\EngineGatedCommandRunner.cs`
+- `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs`
+- `TaskMaster\Ribbon\RibbonController.EngineCommands.cs`
+- `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs`
+
+This satisfies the spec constraint "New files must be nullable-clean under that global override."
+
+The three fixes are documented in `<FEATURE>\evidence\qa-gates\csharpier-format.2026-08-08T14-30.md` under "Phase 6 restart history". None changes runtime behaviour.
+
+### Pre-existing nullable debt (recorded, out of scope)
+
+The residual **220** errors are entirely pre-existing debt in files this change does not touch. Distribution by file (top entries):
+
+| File | Errors |
+|---|---|
+| `TaskMaster\AppGlobals\AppOlObjects.cs` | 58 |
+| `TaskMaster\AppGlobals\AppAutoFileObjects.cs` | 52 |
+| `TaskMaster\AppGlobals\AppToDoObjects.cs` | 48 |
+| `TaskMaster\AppGlobals\AppOlObjects.FolderTreeService.cs` | 48 |
+| `TaskMaster\AppGlobals\AppStagingFilenames.cs` | 40 |
+| `TaskMaster\AppGlobals\ApplicationGlobals.cs` | 40 |
+| `TaskMaster\AppGlobals\AppOlObjects.JunkFolders.cs` | 20 |
+| `TaskMaster\AppGlobals\AppItemEngines.cs` | 18 |
+| `TaskMaster\Ribbon\TryFunctionalityInConstruction.cs` | 16 |
+| `TaskMaster\Ribbon\RibbonController.cs` | 14 |
+| `TaskMaster\Ribbon\RibbonViewer.cs` | 12 |
+| `TaskMaster\Ribbon\RibbonController.Intelligence.cs` | 12 |
+
+(Error counts are double-counted by MSBuild, which prints each diagnostic once inline and once in the summary; the relative distribution is what matters.)
+
+The `TaskMaster\Ribbon\RibbonViewer.cs` diagnostics are at merge-base constructs (the two constructors at lines 35 and 42, `_controller = null;` at line 47, and `return null;` at line 81), none of which this change authored — the only line this change touched in that file is the `partial` keyword on the class declaration.
+
+Two of the pre-existing files, `TaskMaster\AppGlobals\AppItemEngines.cs` (18 errors) and `TaskMaster\AppGlobals\ApplicationGlobals.cs` (40 errors), are AC15-protected zero-line-diff paths and must not be edited by this change under any circumstances.
+
+This pre-existing debt is recorded here for the orchestrator; it is out of scope for #503 and is not remediated. The plan-specified P6-T5 gate (`/t:Build`) is symmetric between the merge-base baseline and this run, and both report `EXIT_CODE: 0`.
+
+Binary outcome: **PASS**.
+
+This task mutated no source file.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md
new file mode 100644
index 000000000..450a65de8
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md
@@ -0,0 +1,32 @@
+# Phase 3 QC Step 5 — Nullable / Type-Check Gate (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T5]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+    5 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:01.58
+```
+
+- **Errors: 0.** The policy-mandated type-check gate passes.
+- **Warnings: 5**, all instances of the pre-existing `System.Reactive` packages.config advisory recorded in the P0-T9 and P0-T10 baselines. Identical to the P0-T10 baseline.
+
+## Known limitation of this gate, restated (issue #512, out of scope)
+
+Exit 0 from this command **alone does not prove the tree is nullable-clean**. MSBuild's up-to-date check skips the `CoreCompile` target when only `/p:` property values change relative to the previous build, so the compiler is never re-invoked with `Nullable=enable` in force. The elapsed time of **1.58 seconds** for a full-solution build — against roughly 8-19 seconds for every build in this cycle that did compile — is direct evidence that no compilation occurred in this invocation. The figure is within 0.03 seconds of the identical P0-T10 baseline measurement of 1.55 seconds.
+
+`code-review.2026-08-08T14-15.md` independently established the substance behind the gate: a forced `/t:Rebuild` of `TaskMaster.csproj` surfaces 195 errors, 64 of them `CS86xx`, all in files untouched by this feature branch, with **zero** attributable to any of the six new production files.
+
+This gate defect and the underlying repository-wide nullable debt are tracked as issue **#512** and are **explicitly out of scope for this remediation cycle**. They are restated here, not remediated.
+
+## Why the limitation does not weaken this cycle's result
+
+This cycle's only source change is `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, which introduces no new nullable surface. The one nullable-flow construct it adds, the null-forgiving `getEnabled!` at line 209, is a suppression rather than a new warning source, and the file **was** genuinely compiled during this cycle: the P3-T4 analyzer build (19 seconds elapsed, `CoreCompile` executed) and the P1-T3 build (which rewrote `TaskMaster.Test.dll`) both compiled it with zero errors and zero diagnostics.
+
+Binary outcome satisfied: `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md
new file mode 100644
index 000000000..1f403d418
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md
@@ -0,0 +1,38 @@
+# AC23 Per-Type Coverage for the Four New Types — Issue #503 (P6-T7)
+
+Timestamp: 2026-08-08T14-54
+
+Source artifact: `<FEATURE>\evidence\qa-gates\coverage-final.cobertura.xml` (produced by P6-T6)
+
+Command (XML query):
+```powershell
+$doc = New-Object System.Xml.XmlDocument
+$doc.Load('...\evidence\qa-gates\coverage-final.cobertura.xml')
+foreach ($t in 'TaskMaster.EngineCommandCatalog','TaskMaster.EngineReadinessGate',
+                'TaskMaster.EngineGatedCommandRunner','TaskMaster.EngineCommandRefreshPlanner') {
+    $nodes = $doc.SelectNodes("//class[@name='$t']")
+    # report the declared line-rate / branch-rate, and independently recompute
+    # line coverage as (count of .//line with hits > 0) / (count of .//line)
+}
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+| Type | Source file | Declared `line-rate` | Recomputed line-rate | Lines | Covered | `branch-rate` | >= 0.90? |
+|---|---|---|---|---|---|---|---|
+| `TaskMaster.EngineCommandCatalog` | `TaskMaster\Ribbon\EngineCommandCatalog.cs` | **1** | 1.000000 | 48 | 48 | 1 | **Yes** |
+| `TaskMaster.EngineReadinessGate` | `TaskMaster\Ribbon\EngineReadinessGate.cs` | **1** | 1.000000 | 48 | 48 | 1 | **Yes** |
+| `TaskMaster.EngineGatedCommandRunner` | `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | **1** | 1.000000 | 72 | 72 | 0.928571 | **Yes** |
+| `TaskMaster.EngineCommandRefreshPlanner` | `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | **1** | 1.000000 | 18 | 18 | 1 | **Yes** |
+
+Each type resolves to exactly one `<class>` element in the Cobertura document, so no aggregation across duplicate entries was required. The recomputed line-rate — derived independently as the fraction of `<line>` descendants whose `hits` attribute is greater than zero — agrees with the declared `line-rate` for all four types.
+
+Every one of the four values is **1.000000**, comfortably at or above the 0.90 floor. No additional test cases are required, so no restart of the Phase 6 loop at P6-T1 is triggered.
+
+The one sub-1.0 figure is a *branch* rate (`EngineGatedCommandRunner` at 0.928571, 13 of 14 branches). AC23 gates on **line** coverage, and 0.928571 is in any case above both the CLAUDE.md 0.90 new-code floor and the `.claude/rules/general-unit-test.md` 0.75 branch floor.
+
+These figures are only meaningful because none of the four types carries `[ExcludeFromCodeCoverage]` — verified independently in `<FEATURE>\evidence\qa-gates\no-coverage-exclusion.2026-08-08T14-10.md`. Every line of readiness decision logic is in the coverage denominator.
+
+Binary outcome: **PASS** — all four values are at or above 0.90.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-coverage-exclusion.2026-08-08T14-10.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-coverage-exclusion.2026-08-08T14-10.md
new file mode 100644
index 000000000..3329d4ea4
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-coverage-exclusion.2026-08-08T14-10.md
@@ -0,0 +1,40 @@
+# AC26 Coverage-Exclusion Audit — Issue #503 (P5-T2)
+
+Timestamp: 2026-08-08T14-10
+
+Command (attribute form, the form AC26 forbids):
+```
+grep -n "^\s*\[ExcludeFromCodeCoverage" TaskMaster/Ribbon/EngineCommandCatalog.cs TaskMaster/Ribbon/EngineReadinessGate.cs TaskMaster/Ribbon/EngineGatedCommandRunner.cs TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+```
+
+Corroborating command (all textual mentions, to prove nothing was missed):
+```
+grep -n "ExcludeFromCodeCoverage" TaskMaster/Ribbon/EngineCommandCatalog.cs TaskMaster/Ribbon/EngineReadinessGate.cs TaskMaster/Ribbon/EngineGatedCommandRunner.cs TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+grep -c "System.Diagnostics.CodeAnalysis" <same four files>
+```
+
+EXIT_CODE: 1 for the attribute grep (ripgrep/grep convention: no match found — the required result), 0 for the corroborating greps.
+
+## Output Summary
+
+**Zero `[ExcludeFromCodeCoverage]` attribute occurrences across all four files.** The attribute-form grep returned no lines.
+
+Every textual occurrence of the string is inside an XML documentation comment stating the opposite intent:
+
+```
+TaskMaster/Ribbon/EngineCommandCatalog.cs:20:    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+TaskMaster/Ribbon/EngineReadinessGate.cs:25:    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+TaskMaster/Ribbon/EngineGatedCommandRunner.cs:27:    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs:22:    /// This type is deliberately NOT marked <c>[ExcludeFromCodeCoverage]</c>: it is host-neutral
+```
+
+Independent corroboration: none of the four files imports `System.Diagnostics.CodeAnalysis` (count 0 in each), so the attribute could not be applied even in an unqualified form.
+
+| File | `[ExcludeFromCodeCoverage]` attribute occurrences |
+|---|---|
+| `TaskMaster\Ribbon\EngineCommandCatalog.cs` | **0** |
+| `TaskMaster\Ribbon\EngineReadinessGate.cs` | **0** |
+| `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | **0** |
+| `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | **0** |
+
+Binary outcome: **PASS** — zero occurrences across all four files. All readiness decision logic is measurable by the coverage tool, which is what makes the AC23 >= 90% per-type floor a real gate rather than a vacuous one.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-new-broad-catch.2026-08-08T14-14.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-new-broad-catch.2026-08-08T14-14.md
new file mode 100644
index 000000000..94868b364
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/no-new-broad-catch.2026-08-08T14-14.md
@@ -0,0 +1,45 @@
+# AC14 (second clause) Broad-Catch Audit — Issue #503 (P5-T4)
+
+Timestamp: 2026-08-08T14-14
+
+Commands (run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`):
+
+```
+# per-file absolute count over every added/modified .cs path in the section 4 scope lock
+for f in <13 scope-locked .cs paths>; do grep -cE 'catch ?\(Exception' $f; done
+
+# delta against the merge-base
+git diff 003c5715055d7d1933db68a742531332756e30b2..HEAD -- '*.cs' | grep -cE "^\+.*catch ?\(Exception"
+git diff 003c5715055d7d1933db68a742531332756e30b2..HEAD -- '*.cs' | grep -cE "^-.*catch ?\(Exception"
+```
+
+The pattern `catch ?\(Exception` matches both spellings the plan names, `catch (Exception` and `catch(Exception`.
+
+EXIT_CODE: 0
+
+## Output Summary — absolute counts
+
+| Scope-locked `.cs` path | `catch (Exception` / `catch(Exception` occurrences |
+|---|---|
+| `TaskMaster\Ribbon\EngineCommandCatalog.cs` | 0 |
+| `TaskMaster\Ribbon\EngineReadinessGate.cs` | 0 |
+| `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | 0 |
+| `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | 0 |
+| `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` | 0 |
+| `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` | 0 |
+| `TaskMaster\Ribbon\RibbonViewer.cs` | 0 |
+| `TaskMaster\ThisAddIn.cs` | 0 |
+| `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs` | 0 |
+| `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs` | 0 |
+| `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` | 0 |
+| `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs` | 0 |
+| `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | 0 |
+
+## Output Summary — delta relative to `<MERGE_BASE>`
+
+- Added lines matching the pattern across all `.cs` files in the branch diff: **0**
+- Removed lines matching the pattern across all `.cs` files in the branch diff: **0**
+
+`EngineGatedCommandRunner` contains no `catch` clause of any kind. When the gate is open, `RunAsync` returns `action()` directly, so an exception thrown by a ready action propagates unchanged to the caller. This is the structural guarantee behind AC14: the guard suppresses *invocation*, never *errors*, and cannot degenerate into a swallow-all. It is exercised at runtime by `RunAsync_WhenActionThrows_PropagatesException`.
+
+Binary outcome: **PASS** — zero added occurrences relative to `<MERGE_BASE>`, and zero absolute occurrences in every scope-locked `.cs` path.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/office-surface-audit.2026-08-08T14-12.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/office-surface-audit.2026-08-08T14-12.md
new file mode 100644
index 000000000..2e80d2091
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/office-surface-audit.2026-08-08T14-12.md
@@ -0,0 +1,80 @@
+# AC27 Architecture-Boundary / Office-Surface Audit — Issue #503 (P5-T3)
+
+Timestamp: 2026-08-08T14-12
+
+Commands (run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`; `<FOUR>` denotes the four new decision files `TaskMaster/Ribbon/EngineCommandCatalog.cs`, `TaskMaster/Ribbon/EngineReadinessGate.cs`, `TaskMaster/Ribbon/EngineGatedCommandRunner.cs`, `TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs`):
+
+```
+grep -n "Microsoft\.Office\." <FOUR>
+grep -nE "(^|[^a-zA-Z.])Office\." <FOUR>
+grep -c "System.Diagnostics.CodeAnalysis" <FOUR>
+git diff 003c5715055d7d1933db68a742531332756e30b2..HEAD -- '*.cs' | grep -E "^\+\s*\[.*ComVisible"
+git diff 003c5715055d7d1933db68a742531332756e30b2..HEAD -- '*.cs' | grep -E "^\+" | grep -oE "[A-Za-z_]+\(Office\.IRibbonControl" | sed 's/(Office.*//' | sort -u   # added
+git diff 003c5715055d7d1933db68a742531332756e30b2..HEAD -- '*.cs' | grep -E "^-" | grep -oE "[A-Za-z_]+\(Office\.IRibbonControl" | sed 's/(Office.*//' | sort -u   # removed
+comm -23 added removed
+```
+
+EXIT_CODE: 0 (all commands executed; individual grep exit codes recorded per fact below)
+
+## Fact 1 — the four new decision files contain no Office surface
+
+`grep -nE "(^|[^a-zA-Z.])Office\."` over the four files returns **no lines** (exit 1). There is no `Office.` type reference of any kind.
+
+`grep -n "Microsoft\.Office\."` returns exactly four lines, all inside XML documentation comments asserting the absence:
+
+```
+TaskMaster/Ribbon/EngineCommandCatalog.cs:21:    /// decision logic, contains no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+TaskMaster/Ribbon/EngineReadinessGate.cs:26:    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+TaskMaster/Ribbon/EngineGatedCommandRunner.cs:28:    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs:23:    /// decision logic with no COM and no <c>Microsoft.Office.*</c> reference, and is fully
+```
+
+There is **zero** `using Microsoft.Office.*` and **zero** `using Microsoft.Office.Interop.Outlook` directive in any of the four. Their complete using sets are:
+
+| File | Using directives |
+|---|---|
+| `EngineCommandCatalog.cs` | `System`, `System.Collections.Generic`, `System.Collections.ObjectModel` |
+| `EngineReadinessGate.cs` | `System`, `UtilitiesCS` |
+| `EngineGatedCommandRunner.cs` | `System`, `System.Globalization`, `System.Threading.Tasks` |
+| `EngineCommandRefreshPlanner.cs` | `System` |
+
+This satisfies `.claude/rules/architecture-boundaries.md` rules 1, 2, and 8: the decision logic is host-neutral and would port unchanged to an Office.js command surface.
+
+## Fact 2 — exactly one new `Microsoft.Office.*`-typed member in the branch diff
+
+Net new Office-typed member declarations, computed as (added member names matching `<name>(Office.IRibbonControl`) minus (removed member names matching the same pattern):
+
+```
+EngineCommand_GetEnabled
+GetEnabled
+```
+
+`GetEnabled` is **not** a member. It is a single XML documentation-comment occurrence naming the Office-required signature shape:
+
+```
++        /// <c>public bool GetEnabled(Office.IRibbonControl control)</c>.
+```
+
+The net new member set is therefore exactly:
+
+```
+public bool EngineCommand_GetEnabled(Office.IRibbonControl control)
+```
+
+declared in `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` on the pre-existing `[ComVisible(true)] [ExcludeFromCodeCoverage] RibbonViewer`.
+
+The 26 other `Office.IRibbonControl`-typed members that appear as `+` lines in the raw diff (`ClearSpam_Click`, `TrainSpam_Click`, `TrainHam_Click`, `TestSpam_Click`, `TestSpamVerbose_Click`, `SpamMetrics_Click`, `SpamInvestigateErrors_Click`, `SpamBayesEnabled_Click`, `SpamBayesEnabled_GetPressed`, `SpamSaveNetwork_Click`, `SpamSaveLocal_Click`, `GetSaveLocation_Click`, `SpamFolderSettings_Click`, `TriageSelection_Click`, `TriageSetA_Click`, `TriageSetB_Click`, `TriageSetC_Click`, `ClearTriage_Click`, `ResetTriage_Click`, `SetPrecision_Click`, `FilterViewer_Click`, `TriageEnabled_Click`, `TriageEnabled_GetPressed`, `TriageSaveNetwork_Click`, `TriageSaveLocal_Click`, `TriageGetSaveLocation_Click`) each have a matching `-` line from `RibbonViewer.cs`: they are the P3-T4 relocation, not new members. The `comm -23` subtraction removes them, which is why they do not appear in the net set.
+
+## Fact 3 — the branch diff adds zero new `[ComVisible(true)]` attributes
+
+`git diff <MERGE_BASE>..HEAD -- '*.cs' | grep -E "^\+\s*\[.*ComVisible"` returns **no lines** (exit 1).
+
+The only added line containing the string `ComVisible` is an XML documentation comment in `RibbonViewer.EngineCommands.cs`:
+
+```
++    /// Thin COM/VSTO glue only. The <c>[ComVisible(true)]</c> and <c>[ExcludeFromCodeCoverage]</c>
+```
+
+`TaskMaster\Ribbon\RibbonViewer.cs` still declares exactly one `ComVisible` attribute (verified: `grep -c "ComVisible" TaskMaster/Ribbon/RibbonViewer.cs` returns 1). Making the class `partial` added no second attribute and introduced no new COM-visible type, satisfying architecture-boundary rule 3.
+
+Binary outcome: **PASS** on all three facts.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/ready-path-preservation.2026-08-08T14-20.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/ready-path-preservation.2026-08-08T14-20.md
new file mode 100644
index 000000000..356ae5d27
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/ready-path-preservation.2026-08-08T14-20.md
@@ -0,0 +1,62 @@
+# AC16 Ready-Path Preservation — Issue #503 (P5-T7)
+
+Timestamp: 2026-08-08T14-20
+
+Command (extracts the merge-base handler expressions for direct comparison against the post-change lambda bodies):
+```
+git show 003c5715055d7d1933db68a742531332756e30b2:TaskMaster/Ribbon/RibbonViewer.cs | sed -n '255,264p;303,310p;316,317p;325,326p'
+```
+Post-change bodies were taken from `<FEATURE>\evidence\qa-gates\lambda-deferral-audit.2026-08-08T14-18.md`, which extracted them verbatim from `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs`.
+
+EXIT_CODE: 0
+
+## Output Summary — merge-base expression vs post-change lambda body
+
+| # | Handler | Merge-base awaited expression | Post-change lambda body | Invoked expression text unchanged? |
+|---|---|---|---|---|
+| 1 | `TrainSpam_Click` | `Controller.SB.TrainAsync(Controller.OlSelection, true)` | `Controller.SB.TrainAsync(Controller.OlSelection, true)` | **Unchanged** |
+| 2 | `TrainHam_Click` | `Controller.SB.TrainAsync(Controller.OlSelection, false)` | `Controller.SB.TrainAsync(Controller.OlSelection, false)` | **Unchanged** |
+| 3 | `TestSpam_Click` | `((SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine).TestAsync(Controller.OlSelection)` | `((SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine).TestAsync(Controller.OlSelection)` | **Unchanged** |
+| 4 | `TriageSetA_Click` | `_controller.Triage.OlLogic.TrainSelectionAsync("A")` | `_controller.Triage.OlLogic.TrainSelectionAsync("A")` | **Unchanged** |
+| 5 | `TriageSetB_Click` | `_controller.Triage.OlLogic.TrainSelectionAsync("B")` | `_controller.Triage.OlLogic.TrainSelectionAsync("B")` | **Unchanged** |
+| 6 | `TriageSetC_Click` | `_controller.Triage.OlLogic.TrainSelectionAsync("C")` | `_controller.Triage.OlLogic.TrainSelectionAsync("C")` | **Unchanged** |
+| 7 | `ClearTriage_Click` | `_controller.Triage.OlLogic.UnTrainSelectionAsync()` | `_controller.Triage.OlLogic.UnTrainSelectionAsync()` | **Unchanged** |
+| 8 | `FilterViewer_Click` | `_controller.Triage.OlLogic.FilterViewAsync()` | `_controller.Triage.OlLogic.FilterViewAsync()` | **Unchanged** |
+
+Merge-base source, verbatim:
+
+```
+        public async void TrainSpam_Click(Office.IRibbonControl control) =>
+            await Controller.SB.TrainAsync(Controller.OlSelection, true);
+
+        public async void TrainHam_Click(Office.IRibbonControl control) =>
+            await Controller.SB.TrainAsync(Controller.OlSelection, false);
+
+        public async void TestSpam_Click(Office.IRibbonControl control) =>
+            await (
+                (SpamBayes)Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine
+            ).TestAsync(Controller.OlSelection);
+
+        public async void TriageSetA_Click(Office.IRibbonControl control) =>
+            await _controller.Triage.OlLogic.TrainSelectionAsync("A");
+
+        public async void TriageSetB_Click(Office.IRibbonControl control) =>
+            await _controller.Triage.OlLogic.TrainSelectionAsync("B");
+
+        public async void TriageSetC_Click(Office.IRibbonControl control) =>
+            await _controller.Triage.OlLogic.TrainSelectionAsync("C");
+
+        public async void ClearTriage_Click(Office.IRibbonControl control) =>
+            await _controller.Triage.OlLogic.UnTrainSelectionAsync();
+
+        public async void FilterViewer_Click(Office.IRibbonControl control) =>
+            await _controller.Triage.OlLogic.FilterViewAsync();
+```
+
+## Assessment
+
+In all eight cases the invoked expression text is byte-identical to the merge-base. The only structural change is that the expression is now the body of a `Func<Task>` lambda handed to `Controller.RunEngineCommandAsync(<control id>, ...)` instead of being the direct operand of `await`. On the ready path the runner returns `action()` directly, so the awaited task is the same task the merge-base awaited, produced by the same expression, on the same thread. Once engines are loaded the behaviour is therefore identical to today's, which is exactly what R6 and AC16 require.
+
+Corroborating runtime evidence: `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` (the action runs exactly once, with zero notifications) and `RunAsync_WhenEngineReady_AwaitsActionToCompletion` (the returned task does not complete until the action's task completes).
+
+Binary outcome: **PASS**.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/refresh-wiring-audit.2026-08-08T14-22.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/refresh-wiring-audit.2026-08-08T14-22.md
new file mode 100644
index 000000000..d6ca9cd93
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/refresh-wiring-audit.2026-08-08T14-22.md
@@ -0,0 +1,89 @@
+# AC18 Refresh-Wiring Audit — Issue #503 (P5-T8)
+
+Timestamp: 2026-08-08T14-22
+
+Commands (run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`):
+```
+sed -n '/internal void InvalidateEngineCommands/,/^        }/p' TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+sed -n '74,86p' TaskMaster/ThisAddIn.cs
+grep -rn "RefreshEngineCommands()" --include=*.cs .        # call-site enumeration
+```
+
+EXIT_CODE: 0
+
+## Fact 1 — `InvalidateEngineCommands()` returns without throwing when `_ribbon` is null
+
+```csharp
+        internal void InvalidateEngineCommands()
+        {
+            var ribbon = _ribbon;
+            if (ribbon is null)
+            {
+                return;
+            }
+
+            var dispatcher = UiThread.Dispatcher;
+            if (dispatcher != null && !dispatcher.CheckAccess())
+            {
+                dispatcher.Invoke(
+                    () => EngineCommandRefreshPlanner.InvalidateAll(ribbon.InvalidateControl)
+                );
+                return;
+            }
+
+            EngineCommandRefreshPlanner.InvalidateAll(ribbon.InvalidateControl);
+        }
+```
+
+`_ribbon` is assigned only in `Ribbon_Load` (`RibbonViewer.cs`). Before that runs it is null, and the method returns immediately — a plain `return`, with no `throw` on any path. `_ribbon` is captured into a local `ribbon` before the null test, so the value used inside the marshalled lambda cannot be a different (or newly-nulled) instance than the one that passed the check.
+
+`RibbonController.RefreshEngineCommands()` additionally guards its side of the call:
+
+```csharp
+        internal void RefreshEngineCommands()
+        {
+            _viewer?.InvalidateEngineCommands();
+        }
+```
+
+so an early refresh before `SetViewer` is also a no-op rather than a `NullReferenceException`.
+
+## Fact 2 — the `IRibbonUI` call is explicitly marshalled through `UiThread.Dispatcher`
+
+The method reads `UiThread.Dispatcher` (declared in `UtilitiesCS\Threading\UiThread.cs`, namespace `UtilitiesCS`) and calls `CheckAccess()`. When the current thread is **not** the dispatcher thread, the invalidation is executed through `dispatcher.Invoke(...)`; only when already on the dispatcher thread does it call through directly. It does **not** rely on the ambient `SynchronizationContext`.
+
+This is required because `IRibbonUI` is an Office COM object handed to `Ribbon_Load` on the STA and must be called back on the STA. `AppItemEngines.InitAsync()` is launched via `Task.Run` (`ApplicationGlobals.cs`), so it completes on a thread-pool thread; the continuation resumes on the STA only when a synchronization context happened to be captured, which is true on the `Application_Startup` path but not on the `LoadWhenIdle()` (`useUiThread: false`) or `LoadParallelAsync()` paths. The explicit marshalling makes the refresh correct on every load path.
+
+## Fact 3 — `ThisAddIn` invokes the refresh exactly once, immediately after `await _globals.LoadAsync(false);`
+
+`grep -rn "RefreshEngineCommands()" --include=*.cs .` (excluding `.claude/` worktree paths) returns exactly two lines:
+
+```
+./TaskMaster/Ribbon/RibbonController.EngineCommands.cs:76:        internal void RefreshEngineCommands()
+./TaskMaster/ThisAddIn.cs:82:                    _ribbonController.RefreshEngineCommands();
+```
+
+The first is the declaration; the second is the single call site in the entire repository. Its context:
+
+```csharp
+                {
+                    _currentStartupStageLabel = StartupStageLabels.Loading;
+                    await _globals.LoadAsync(false);
+
+                    // Issue #503: this refresh is load-bearing, not cosmetic. Office caches each
+                    // getEnabled response per control until the add-in invalidates it, so without
+                    // this call the eight engine-backed buttons remain disabled for the whole
+                    // session even after AppItemEngines.InitAsync() has succeeded.
+                    _ribbonController.RefreshEngineCommands();
+
+                    logger.Debug("Finished loading globals");
+                    _currentStartupStageLabel = StartupStageLabels.PostLoad;
+                    _startupPostLoadReached = true;
+                }
+```
+
+The call is the first statement after `await _globals.LoadAsync(false);`, inside the `IdleAsyncQueue.AddEntry(true, ...)` entry — that is, the entry enqueued with `useUiThread: true`.
+
+Corroborating unit evidence for the decision half: `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` asserts the invalidated id set equals `EngineCommandCatalog.ControlIds` as a set, and `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException` pins the precondition. Both `RibbonViewer.InvalidateEngineCommands` and `RibbonController.RefreshEngineCommands` are inside `[ExcludeFromCodeCoverage]` types by design and are verified here by source inspection, as AC18 specifies.
+
+Binary outcome: **PASS** on all three facts.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-commit.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-commit.2026-08-08T14-52.md
new file mode 100644
index 000000000..e6ea91484
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-commit.2026-08-08T14-52.md
@@ -0,0 +1,38 @@
+# Phase 4 — Remediation Commit (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P4-T3]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'fix(#503): make the AC5 ribbon-XML assertion non-vacuous and restore RibbonExplorer.xml line count'; git rev-parse HEAD; git status --porcelain"`
+EXIT_CODE: 0
+
+## Pre-commit gate satisfied
+
+This task may execute only after the P1-T8 restoration artifact records an empty porcelain for `TaskMaster/Ribbon/RibbonExplorer.xml`; committing while the P1-T5 mutation is present is a hard failure. Both checks were performed:
+
+1. `evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md` records the empty porcelain, 539 lines, and 8 `getEnabled` occurrences after `git checkout --`.
+2. `git status --porcelain -- TaskMaster/Ribbon/RibbonExplorer.xml` was re-run immediately before `git add -A` and returned **empty output**, independently confirming the mutation was absent at commit time.
+
+The commit therefore contains **no part** of the P1-T5 mutation. `TaskMaster/Ribbon/RibbonExplorer.xml` does not appear in the commit at all.
+
+## Output Summary
+
+| Item | Value |
+|---|---|
+| New HEAD SHA | **`00bc47bb2d9f82cc4b63b13fbfbd251627e858b1`** |
+| Previous HEAD (P0-T5 audit record) | `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c` |
+| Commit subject | `fix(#503): make the AC5 ribbon-XML assertion non-vacuous and restore RibbonExplorer.xml line count` |
+| Post-commit `git status --porcelain` | **empty** |
+
+### Note on the commit subject
+
+The subject line is the text pinned verbatim by the plan and was used unmodified. Its second clause, "restore RibbonExplorer.xml line count", **overstates the delivered outcome**: the F2 line restoration was reverted at [P3-T2] because CSharpier 1.3.0 rejects the single-line form, and `RibbonExplorer.xml` takes a zero-line diff in this commit. The accurate scope of the commit is the F1 fix plus documentation and evidence. This discrepancy is recorded here rather than silently corrected, because the subject text was pinned by the approved plan; `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md` and the `spec.md` Remediation Cycle 1 subsection both carry the correct account.
+
+## Commit contents
+
+The one source path in the commit:
+
+- `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` — the F1 fix (+12 / -3).
+
+Everything else is documentation, evidence, and agent-memory: the `spec.md` append-only subsection, this cycle's evidence artifacts under `evidence/remediation-baseline/`, `evidence/regression-testing/`, `evidence/qa-gates/`, and `evidence/other/`, the plan and inputs artifacts, the review-cycle artifacts carried in as P3-T11 bucket (c), and `.claude/agent-memory/**` updates.
+
+Binary outcome satisfied: `git status --porcelain` is **empty** after the commit.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-reaudit-handoff.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-reaudit-handoff.2026-08-08T14-52.md
new file mode 100644
index 000000000..84fa54995
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/remediation-reaudit-handoff.2026-08-08T14-52.md
@@ -0,0 +1,91 @@
+# Remediation Cycle 1 — Reaudit Handoff (Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P4-T5]
+Post-commit HEAD: **`00bc47bb2d9f82cc4b63b13fbfbd251627e858b1`**
+Branch: `bug/ribbon-engine-readiness-guard-503`
+Merge-base: `003c5715055d7d1933db68a742531332756e30b2`
+Blocking findings entering the reaudit: **0**
+
+## Finding disposition
+
+| Finding | Status | Evidence |
+|---|---|---|
+| **F1** — vacuous assertion in the AC5 ribbon-XML test | **RESOLVED** | `evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md`, `evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md`, `evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md`, `evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md` |
+| **F2** — `RibbonExplorer.xml` line growth | **NOT REMEDIABLE AS SPECIFIED — escalated, not fixed** | `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`, `evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md` (superseded), `evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md`, `evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md` |
+
+### F1 — resolved and proven
+
+The null-conditional operator was removed from `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback`. The attribute is bound to a local and asserted `NotBeNull` before `Value` is dereferenced, so all three required failure conditions reach a real assertion.
+
+Non-vacuity was **demonstrated, not asserted**, by a recorded mutate-build-fail-restore cycle in which the embedded byte content was verified at each step so the proof could not be a stale-assembly false negative:
+
+| Step | Embedded `getEnabled` count | AC5 test | Exit |
+|---|---|---|---|
+| Green before mutation (P1-T4) | 8 | Passed | 0 |
+| **Failing run with the mutation (P1-T7)** | **7** | **Failed** | **1** |
+| Restored (P1-T8) | 8 | — | 0 |
+| Pass after restore (P1-T10) | 8 | Passed | 0 |
+
+Verbatim failure message from the recorded failing run:
+
+```text
+Expected getEnabled not to be <null> because control 'TrainSpam' is engine-backed and must declare a getEnabled callback.
+   at FluentAssertions.Primitives.ReferenceTypeAssertions`2.NotBeNull(String because, Object[] becauseArgs)
+   at TaskMaster.Test.Ribbon.RibbonExplorerXmlTests.RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback() in ...\RibbonExplorerXmlTests.cs:line 202
+```
+
+The permanent tree retains no part of the mutation: `git status --porcelain` is empty and `TaskMaster/Ribbon/RibbonExplorer.xml` is absent from the remediation commit.
+
+### F2 — escalated with measured cause
+
+The pinned edit was made and reverted. CSharpier **1.3.0 formats XML**; `.csharpierignore` excludes `*.csproj`/`*.props`/`*.targets` but not `*.xml`; the default print width is 100 columns. The merge-base single-line form is 78 characters; adding the functionally required `getEnabled="EngineCommand_GetEnabled"` makes it **116 characters**. The formatter therefore mandates the multi-line form, the 12 lines the review called "incidental churn with no functional purpose" are formatter-mandated, and the 527-line target is unreachable while the mandatory format gate must pass.
+
+`RibbonExplorer.xml` remains at **539 lines** and takes a **zero-line diff** from this cycle. All eight `getEnabled="EngineCommand_GetEnabled"` attributes remain present and correct, the resource still parses as valid CustomUI, and the AC5/AC6/AC7/AC8 ribbon-XML tests all pass. Per the executor directive, this newly discovered conflict is recorded for the orchestrator to promote and was **not** fixed; no `.csharpierignore`, `.csharpierrc`, or other gate configuration was modified.
+
+## Acceptance criteria — no state changed
+
+**No acceptance criterion was checked off or unchecked in this cycle.** `git diff -U0 -- .../spec.md | grep -E '^[+-].*- \[[ x]\]'` returns no match, and `git diff --numstat -- .../spec.md` reports `12  0` (twelve added, zero deleted). The only `spec.md` edit is the append-only `### Remediation Cycle 1 — 2026-08-08T14-26` subsection under `## Delivery Notes and Deviations`.
+
+**AC19, AC20, and AC21 remain unchecked**, each still beginning `- [ ]`, verified verbatim in `evidence/qa-gates/manual-only-unchecked.2026-08-08T14-52.md`. They are MANUAL-ONLY and require live-Outlook verification; the maintainer checklist at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` is unchanged and still carries `Status: PENDING MAINTAINER EXECUTION`.
+
+## Out-of-scope items were not touched
+
+None of the following was addressed, re-promoted, or re-litigated:
+
+- Issue **#512** — pre-existing repository-wide nullable debt and the vacuous type-check gate (restated in `evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md`, not remediated).
+- Issue **#510** — the `CS2002` duplicate `<Compile Include>` entry in `UtilitiesCS.Test.csproj` (observed in every analyzer build, not fixed).
+- Issue **#508** — the `YieldAsync_WithoutDispatcher_RemainsStrict` order-dependent flake (passed in both the baseline and final runs; no fix made or attempted).
+- The residual `engine as SpamBayes` / `.Engine` dereference window.
+- The `??=` lazy-initialiser thread-safety observation in `RibbonController.EngineCommands.cs`.
+- `TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` — both verified at a zero-line diff against the merge-base, before and after the commit.
+- Issues **#504**, **#505**, **#506**, **#507**, **#509**, **#511**.
+
+## Toolchain state at handoff
+
+| Gate | Result |
+|---|---|
+| CSharpier format (scope-locked) | exit 0, no rewrite |
+| CSharpier check (repo-wide) | exit 0 over 1498 files, empty unformatted set |
+| MSBuild analyzers | exit 0, 0 errors, 6 warnings all matching the P0-T9 baseline |
+| MSBuild nullable | exit 0 (with the #512 limitation restated) |
+| Tests with coverage | exit 0, **6338/6338 passed**, 0 failed, 0 skipped |
+| First-party LINE coverage | 85.8462% to **85.8561%** (up) |
+| First-party BRANCH coverage | 79.2559% to **79.2702%** (up) |
+| `TaskMaster` package LINE counter | `missed=1464 covered=3515` at all three measurement points |
+
+All five gate commands ran in one uninterrupted pass with no restart; the earlier aborted attempt and its cause are disclosed in `evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md`.
+
+## New defect recorded for promotion, not fixed
+
+**Plan section 3 rule 6 is factually wrong for this toolchain**, and the F2 finding rests on that error. CSharpier 1.3.0 formats XML and enforces its 100-column print width on `RibbonExplorer.xml`. Recommended orchestrator actions: close F2 as not remediable as specified; correct the rule text in future plans; and, if the 500-line overage is to be addressed at all, route a resource-split issue rather than a reformatting change. Full detail in `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+## Trailing evidence commit
+
+The plan places the commit task (P4-T3) **before** the post-commit verification tasks (P4-T4, P4-T5), so those two tasks necessarily produce artifacts after `00bc47bb` exists. `evidence/qa-gates/remediation-commit.2026-08-08T14-52.md`, `evidence/qa-gates/zero-line-diff-postcommit.2026-08-08T14-52.md`, this artifact, and the final Phase 4 plan checklist state are therefore committed in a **second, documentation-and-evidence-only** commit immediately following `00bc47bb`, so the worktree ends clean.
+
+That trailing commit contains **no source path**. The remediation commit `00bc47bb` remains the commit whose diff the P4-T4 scope audit was taken over, and the protected-path verification recorded there is unaffected: neither commit touches `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, or `TaskMaster/AppGlobals/ApplicationGlobals.cs`.
+
+## Binary outcome
+
+Both findings carry at least one evidence pointer. F1 is marked **resolved**. F2 is marked **not remediable as specified** with its measured cause, rather than reported as resolved or silently dropped. Blocking-finding count entering the reaudit: **0**.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md
new file mode 100644
index 000000000..5e5c8891b
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md
@@ -0,0 +1,113 @@
+# Phase 3 QC Step 11 — Source Scope-Lock Audit (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T11]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git status --porcelain"`
+EXIT_CODE: 0
+
+## Verbatim porcelain output
+
+```text
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/feature-review/MEMORY.md
+ M .claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
+ M TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+?? .claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md
+?? .claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md
+?? .claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md
+?? .claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-postrestore.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase1-build-premutation.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-projection.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/coverage-remediation-final.jacoco.xml
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-check.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/csharpier-format.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/file-size-audit.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md
+?? docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md
+```
+
+(The listing above reflects the tree at the time of this audit, including this artifact itself and the `tests-with-coverage.remediation.*` disambiguation described below.)
+
+## Bucket classification — every entry
+
+### Bucket (a) — section 4.1 source path
+
+| Path | Note |
+|---|---|
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | The F1 fix. The **only** source path this cycle modifies. |
+
+`TaskMaster/Ribbon/RibbonExplorer.xml` — the second section 4.1 path — **does not appear**, because it takes a zero-line diff after the P2-T1 revert recorded in `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`. Absence is within the gate: the gate constrains which paths *may* be present, not which *must* be.
+
+### Bucket (b) — section 4.2 documentation and evidence paths
+
+Every path under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/` regardless of extension, including the collapsed directory entry `evidence/remediation-baseline/` and the `.xml` file `evidence/qa-gates/coverage-remediation-final.jacoco.xml`. Also `remediation-plan.2026-08-08T14-26.md` (checklist state only, per section 4.2).
+
+The `.claude/agent-memory/**` paths are section 4.2 permitted paths.
+
+### Bucket (c) — pre-existing uncommitted paths carried in from the review cycle
+
+Each of the following also appears in the P0-T5 porcelain recorded in `evidence/remediation-baseline/git-state.2026-08-08T14-52.md`, so this cycle neither created nor modified them:
+
+| Path | In P0-T5 porcelain |
+|---|---|
+| `.claude/agent-memory/atomic-executor/MEMORY.md` | yes |
+| `.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md` | yes |
+| `.claude/agent-memory/atomic-planner/MEMORY.md` | yes |
+| `.claude/agent-memory/feature-review/MEMORY.md` | yes |
+| `.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md` | yes |
+| `.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md` | yes |
+| `.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md` | yes |
+| `.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md` | yes |
+| `.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md` | yes |
+| `.../code-review.2026-08-08T14-15.md` | yes |
+| `.../feature-audit.2026-08-08T14-15.md` | yes |
+| `.../policy-audit.2026-08-08T14-15.md` | yes |
+| `.../remediation-inputs.2026-08-08T14-26.md` | yes |
+| `docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md` | yes |
+
+### Bucket (d) — violations
+
+**EMPTY.**
+
+## Filename-collision repair recorded
+
+`git status --porcelain` initially reported ` M docs/.../evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md` — a **tracked** file, not an untracked one. That path is a pre-existing committed implementation-cycle artifact (the P6-T6 record) whose timestamp collides exactly with this cycle's `<TS>`. The P3-T6 evidence write had overwritten it.
+
+The original was restored byte-exact with `git checkout --`, and the remediation record re-written to the disambiguated path `evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md`. A re-query confirms **zero** ` M` entries under `evidence/` now, so no committed implementation-cycle evidence is modified by this cycle. This is the only such collision; a comparison of every filename this plan writes against `git ls-files` over the evidence tree found no other.
+
+## Binary outcome
+
+| Condition | Measured | Verdict |
+|---|---|---|
+| Outside `<FEATURE>\evidence\`, the only `.cs`/`.csproj`/`.xml`/`.sln` paths are `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` and `TaskMaster/Ribbon/RibbonExplorer.xml` | exactly one such path: `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | **PASS** |
+| Every bucket (c) entry also appears in the P0-T5 porcelain | 14 of 14 confirmed | **PASS** |
+| Bucket (d) is empty | 0 entries | **PASS** |
+| No `coverage/` or `artifacts/` path appears | 0 matches (both gitignored) | **PASS** |
+| No committed evidence artifact is modified | 0 ` M` entries under `evidence/` | **PASS** |
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/test-determinism-audit.2026-08-08T14-15.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/test-determinism-audit.2026-08-08T14-15.md
new file mode 100644
index 000000000..61e13cbbc
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/test-determinism-audit.2026-08-08T14-15.md
@@ -0,0 +1,53 @@
+# AC28 Test Determinism Audit — Issue #503 (P5-T5)
+
+Timestamp: 2026-08-08T14-15
+
+Files audited (the five test files in plan section 4.3):
+
+1. `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs`
+2. `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs`
+3. `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs`
+4. `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs`
+5. `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`
+
+Command (run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`, one fixed-string grep per banned token, summed across the five files):
+
+```
+for p in "Path.GetTempPath" "Path.GetTempFileName" "Thread.Sleep" "Task.Delay" \
+         "DateTime.Now" "DateTime.UtcNow" "DateTimeOffset.Now" "new Form" "MessageBox" \
+         "Application.Run" "Application.DoEvents" "Microsoft.Office.Interop.Outlook"; do
+  grep -F -c "$p" <five files> | awk -F: '{s+=$2} END {print s}'
+done
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+| Banned token | Occurrences across all five files |
+|---|---|
+| `Path.GetTempPath` | **0** |
+| `Path.GetTempFileName` | **0** |
+| `Thread.Sleep` | **0** |
+| `Task.Delay` | **0** |
+| `DateTime.Now` | **0** |
+| `DateTime.UtcNow` | **0** |
+| `DateTimeOffset.Now` | **0** |
+| `new Form` | **0** |
+| `MessageBox` | **0** |
+| `Application.Run` | **0** |
+| `Application.DoEvents` | **0** |
+| `Microsoft.Office.Interop.Outlook` | **0** |
+
+All twelve counts are zero. No automated test in this change creates a temporary file, sleeps or delays, reads the wall clock, constructs a `Form` or `MessageBox`, starts a WinForms message pump, or touches live COM or Outlook.
+
+Supporting design notes:
+
+- The only asynchronous-completion test, `RunAsync_WhenEngineReady_AwaitsActionToCompletion`, is driven by a `TaskCompletionSource<bool>` that the test itself completes synchronously, so completion is observed with no timing dependency.
+- `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` models the S1 -> S2 transition by mutating the same `ConcurrentDictionary` instance between two synchronous calls, again with no timing dependency.
+- The AC12 notification assertion is made against the injected `Action<string>` sink, never against a presentation surface. `MessageBox.Show` exists only in the coverage-exempt `RibbonController.NotifyEngineCommandNotReady` shim, which no test invokes.
+- `RibbonExplorerXmlTests` reads the ribbon XML from the assembly's embedded resource stream, not from the filesystem, and resolves the Office callback parameter type by `Type.FullName` string comparison rather than by loading an Outlook interop type.
+
+`Thread.Sleep` and `Task.Delay` are additionally enforced by `BannedSymbols.txt` through `Microsoft.CodeAnalysis.BannedApiAnalyzers`; the corresponding analyzer result is recorded in `<FEATURE>\evidence\qa-gates\msbuild-analyzers.<TS>.md`.
+
+Binary outcome: **PASS** — zero occurrences of every audited token.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md
new file mode 100644
index 000000000..b0f9a2dc2
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md
@@ -0,0 +1,51 @@
+# Full-Suite Test Run with Coverage — Issue #503 (P6-T6)
+
+Timestamp: 2026-08-08T14-52
+
+Command:
+```
+pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\qa-gates\coverage-final.cobertura.xml
+```
+(run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`)
+
+EXIT_CODE: **0**
+
+Coverage artifact: `docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\qa-gates\coverage-final.cobertura.xml`
+
+## Output Summary
+
+### Test counts
+
+| Metric | Value |
+|---|---|
+| Result | `Test Run Successful.` |
+| Total tests | **6338** |
+| Passed | **6338** |
+| Failed | **0** |
+| Skipped | **0** |
+
+The suite grew from 6293 (P0-T9 baseline) to 6338, an increase of **45**, matching the tests added by this change: 13 in `EngineGatedCommandRunnerTests` (one of which is a 3-row `[DataTestMethod]`, counted as 3), 11 in `EngineReadinessGateTests` (one of which is a 3-row `[DataTestMethod]`, counted as 3), 6 in `EngineCommandCatalogTests` (one of which is an 8-row `[DataTestMethod]`, counted as 8), 2 in `EngineCommandRefreshPlannerTests`, and 4 added to `RibbonExplorerXmlTests`.
+
+### Numeric root `<coverage>` attributes
+
+| Attribute | Value |
+|---|---|
+| `line-rate` | **0.858516** |
+| `branch-rate` | **0.792487** |
+| `lines-covered` | **95473** |
+| `lines-valid` | **111207** |
+| `branches-covered` | 22131 |
+| `branches-valid` | 27926 |
+| `complexity` | 24678 |
+
+### Failure reconciliation against the P0-T10 pre-existing set
+
+The failure set is **empty**. `Test Run Successful.` was reported and the runner emitted no `Failed:` or `Skipped:` line.
+
+The empty set is trivially a subset of the P0-T10 recorded pre-existing set (which contains the single order-dependent flake `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict`, tracked by issue **#508**). That test **passed** on this run, exactly as it did on the P0-T9 baseline run. No fix for #508 was made or attempted.
+
+No test outside the P0-T10 set failed, so no regression exists and no restart of the Phase 6 loop at P6-T1 is triggered.
+
+Binary outcome: **PASS** — zero skipped tests and zero failed tests.
+
+This task mutated no source file; it wrote only the coverage artifact under `<FEATURE>\evidence\qa-gates\`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md
new file mode 100644
index 000000000..3bf2ac98e
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md
@@ -0,0 +1,67 @@
+# Phase 3 QC Step 6 — Full Test Suite with Coverage (Remediation Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T6]
+Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput coverage\remediation-final.cobertura.xml` run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`
+EXIT_CODE: 0
+
+## Filename disambiguation (recorded)
+
+The plan names this artifact `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. With `<TS>` resolved to `2026-08-08T14-52`, that path **collides exactly** with a pre-existing committed implementation-cycle artifact, `evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md` (the P6-T6 record). The collision was detected at [P3-T11] via `git status --porcelain` reporting that path as ` M` rather than `??`.
+
+The pre-existing artifact was restored byte-exact with `git checkout --` and is unmodified by this cycle. This remediation record is written to the disambiguated path `tests-with-coverage.remediation.2026-08-08T14-52.md`. No implementation-cycle evidence was destroyed. This is the only filename collision in the cycle; every other artifact written by this plan has a name distinct from the committed set.
+
+## Output Summary
+
+### Test counts
+
+```text
+Test Run Successful.
+Total tests: 6338
+     Passed: 6338
+ Total time: 39.8012 Seconds
+```
+
+| Metric | Value | P0-T11 remediation baseline |
+|---|---|---|
+| Total | 6338 | 6338 |
+| Passed | 6338 | 6338 |
+| Failed | **0** | 0 |
+| Skipped | **0** | 0 |
+
+The suite total is unchanged at 6338. This cycle adds no test and removes none; it corrects the assertion body of one existing test.
+
+### Reconciliation of every failure against the P0-T13 pre-existing set
+
+**There are no failures to reconcile.** The observed failure set is **empty**, which is trivially a subset of the P0-T13 set.
+
+| P0-T13 set member | Result this run |
+|---|---|
+| `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` (issue **#508**, order-dependent flake, out of scope) | **Passed** |
+
+No test outside the P0-T13 set failed, so no regression is present and the phase does not restart at P3-T1. No fix for #508 was made or attempted.
+
+### Coverage headline (root `<coverage>` attributes, verbatim)
+
+```xml
+<coverage line-rate="0.858561" branch-rate="0.792702" complexity="24678" version="1.9"
+          timestamp="1786216670" lines-covered="95478" lines-valid="111207"
+          branches-covered="22137" branches-valid="27926">
+```
+
+| Attribute | Value | P0-T11 baseline | Delta |
+|---|---|---|---|
+| `line-rate` | **0.858561** (85.8561%) | 0.858462 (85.8462%) | **+0.0099 points** |
+| `branch-rate` | **0.792702** (79.2702%) | 0.792559 (79.2559%) | **+0.0143 points** |
+| `lines-covered` | **95478** | 95467 | +11 |
+| `lines-valid` | **111207** | 111207 | 0 |
+| `branches-covered` | **22137** | 22133 | +4 |
+| `branches-valid` | **27926** | 27926 | 0 |
+
+Both rates moved **up** on identical denominators, which is the expected result for a cycle that changes one test file and adds no production line. The small positive movement in the numerators is run-to-run instrumentation variance; see `evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md` for the full three-point analysis.
+
+### Artifact location
+
+`coverage\remediation-final.cobertura.xml` — gitignored (`.gitignore:144` ignores `coverage/*`) and **never committed**. P3-T7 projects it into a compact package-level JaCoCo summary; only that summary is written under `<FEATURE>\evidence\`.
+
+Binary outcome satisfied: zero skipped tests and zero failed tests; the failure set is empty and therefore a subset of the P0-T13 set.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md
new file mode 100644
index 000000000..96f492afd
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md
@@ -0,0 +1,57 @@
+# Phase 3 QC Step 12 — Single Uninterrupted Clean Toolchain Pass (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T12]
+
+## The recorded pass, in order
+
+| Order | Task | Gate | Artifact | `EXIT_CODE:` |
+|---|---|---|---|---|
+| 1 | **P3-T1** | Format (CSharpier, scope-locked) | `evidence/qa-gates/csharpier-format.2026-08-08T14-52.md` | **0** |
+| 2 | **P3-T2** | Format verification (CSharpier, repo-wide, read-only) | `evidence/qa-gates/csharpier-check.2026-08-08T14-52.md` | **0** |
+| 3 | **P3-T4** | Lint (MSBuild analyzers) | `evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md` | **0** |
+| 4 | **P3-T5** | Type-check (MSBuild nullable) | `evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md` | **0** |
+| 5 | **P3-T6** | Test with coverage | `evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md` | **0** |
+
+All five gates ran **in one pass, in the order above, with no restart between them.**
+
+## No intervening source change during the pass
+
+The two scope-locked source paths were fingerprinted at the end of the pass:
+
+| Path | `git hash-object` at end of pass | Changed during the pass |
+|---|---|---|
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | `7d422ef399d5be44176acb629a0199bddcf6ff93` | **no** |
+| `TaskMaster/Ribbon/RibbonExplorer.xml` | `9d8403ee3d2e7f02c6d29d73efb25f9e065b461e` | **no** |
+
+The `.cs` hash is identical to the value recorded on **both** sides of the P3-T1 formatting invocation, which is direct evidence that CSharpier did not rewrite the file and that nothing altered it afterwards. `git diff --numstat` over both paths reports `12  3` for the `.cs` file and **no line at all** for the `.xml` file, confirming the XML takes a zero-line diff.
+
+No `.cs`, `.csproj`, `.xml`, or `.sln` file changed on disk between P3-T1 and P3-T6. Writing this phase's own Markdown and JaCoCo evidence artifacts under `<FEATURE>\evidence\` is not an intervening file change, per the phase's own loop semantics.
+
+## Restart history, disclosed
+
+This is the **second** Phase 3 attempt. The first attempt is disclosed in full rather than omitted:
+
+| Attempt | P3-T1 | P3-T2 | Outcome |
+|---|---|---|---|
+| 1 | exit 0 | **exit 1** — `TaskMaster\Ribbon\RibbonExplorer.xml` reported unformatted | **aborted at P3-T2** |
+| **2 (recorded above)** | exit 0 | exit 0 | ran through P3-T6 with no restart |
+
+The first attempt failed because the P2-T1 XML collapse is rejected by CSharpier 1.3.0: the single-line form is 116 characters against a 100-column print width once the required `getEnabled` attribute is present, so the formatter mandates the multi-line form. The cause was fixed by reverting the P2-T1 collapse, and the phase restarted from P3-T1 exactly as its loop semantics require. Measured root cause and escalation: `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+The restart occurred **before** the recorded pass began. The recorded sequence P3-T1 → P3-T2 → P3-T4 → P3-T5 → P3-T6 itself **contains no restart**.
+
+## Supporting gates in the same pass
+
+These ran within the same pass and also passed, and none of them mutated a source file:
+
+| Task | Gate | Artifact | Result |
+|---|---|---|---|
+| P3-T3 | Post-format file-size audit | `evidence/qa-gates/file-size-audit.2026-08-08T14-52.md` | `.cs` at 318/500 PASS; `RibbonExplorer.xml` at 539 recorded as an unmet F2 objective, escalated |
+| P3-T7 | Coverage projection | `evidence/qa-gates/coverage-projection.2026-08-08T14-52.md` | exit 0 |
+| P3-T8 | Canonical gate artifact | `evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md` | exit 0; LINE 85.8561 >= 85, BRANCH 79.2702 >= 75 |
+| P3-T9 | Coverage comparison | `evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md` | no regression; both rates up |
+| P3-T10 | AC15 zero-line diff (working tree) | `evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md` | empty output |
+| P3-T11 | Scope-lock audit | `evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md` | bucket (d) empty |
+
+Binary outcome satisfied: the recorded sequence contains no restart.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md
new file mode 100644
index 000000000..93fd03802
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md
@@ -0,0 +1,60 @@
+# AC22 Single Uninterrupted Clean Toolchain Pass — Issue #503 (P6-T9)
+
+Timestamp: 2026-08-08T14-58
+
+## The recorded pass, in order
+
+| Step | Task | Artifact | EXIT_CODE |
+|---|---|---|---|
+| 1. Format | **P6-T1** `csharpier format <13 scope-locked paths>` | `<FEATURE>\evidence\qa-gates\csharpier-format.2026-08-08T14-30.md` | **0** |
+| 2. Format verify | **P6-T2** `csharpier check .` | `<FEATURE>\evidence\qa-gates\csharpier-check.2026-08-08T14-31.md` | **0** |
+| 3. Lint | **P6-T4** `MSBuild TaskMaster.sln /t:Build /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` | `<FEATURE>\evidence\qa-gates\msbuild-analyzers.2026-08-08T14-35.md` | **0** |
+| 4. Type-check | **P6-T5** `MSBuild TaskMaster.sln /t:Build /p:Nullable=enable /p:TreatWarningsAsErrors=true` | `<FEATURE>\evidence\qa-gates\msbuild-nullable.2026-08-08T14-49.md` | **0** |
+| 5. Test | **P6-T6** `Invoke-MSTestWithCoverage.ps1 -Configuration Debug` | `<FEATURE>\evidence\qa-gates\tests-with-coverage.2026-08-08T14-52.md` | **0** |
+
+All five ran in one pass, in this order, with **no intervening file change and no restart**.
+
+## Proof of no intervening file change
+
+Per this task's definition, "an intervening file change" means a change to a `.cs`, `.csproj`, `.xml`, or `.sln` file only; writing this phase's own evidence artifacts under `<FEATURE>\evidence\qa-gates\` does not count and does not break the pass.
+
+MD5 fingerprints of all sixteen touched source paths were captured immediately after P6-T1 and again immediately after P6-T6. A byte-for-byte `diff` of the two fingerprint sets is **empty**:
+
+```
+diff hashes_pass3_start.txt hashes_pass3_end.txt
+=> no differences
+NO SOURCE FILE CHANGED BETWEEN P6-T1 AND P6-T6
+```
+
+The fingerprints themselves:
+
+```
+03e959b34fee6b3c4357148f762a49b9  TaskMaster/Ribbon/EngineCommandCatalog.cs
+cdcb45ca79029ea502105042111baef9  TaskMaster/Ribbon/EngineReadinessGate.cs
+add3305fcb4aab807fe5935493eea6fc  TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+d7ddac56b3474268f1602ced3ad9e4c3  TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+57f643e929497a643f554a2b7699c177  TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+9990f963ac3f09a3d2917bb152fe4b23  TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+388f1680c66443eb9e8697482ba81a1d  TaskMaster/Ribbon/RibbonViewer.cs
+5eb04850a8edb4df30595f3ad374d5b9  TaskMaster/ThisAddIn.cs
+e6081bfcc4a853be11e549024cbbbbe5  TaskMaster/Ribbon/RibbonExplorer.xml
+1751fa6df7979bbc3f7a234c4993c0f5  TaskMaster/TaskMaster.csproj
+fd30be9c1df80560ecfbd099d38a7060  TaskMaster.Test/TaskMaster.Test.csproj
+2eae440dd29f188dccca61dd27896550  TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+c0545768fa69282e50526990428f1a97  TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+25efd8b02f36fc87e5bf78426040a0a1  TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+18c90184f94643ef4bcbb2832be9acd4  TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+9b4c453318e284c445122d4953ac0135  TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+```
+
+Additionally, P6-T1 itself rewrote nothing on this pass (verified by a before/after fingerprint comparison around the format invocation), so the pass begins from a formatter-stable tree.
+
+## Restart history (transparency)
+
+The Phase 6 loop was entered three times. Restarts 1 and 2 occurred **before** this recorded pass began and are documented in `<FEATURE>\evidence\qa-gates\csharpier-format.2026-08-08T14-30.md`:
+
+1. Attempt 1 restarted because P6-T1 rewrote 10 of 13 files.
+2. Attempt 2 restarted because P6-T5 verification surfaced three nullable diagnostics in authored code, which required three minimal source fixes.
+3. Attempt 3 is the pass recorded above, and contains **no restart**.
+
+Binary outcome: **PASS** — the recorded sequence P6-T1, P6-T2, P6-T4, P6-T5, P6-T6 contains no restart and no intervening source-file change, and every step returned `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postcommit.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postcommit.2026-08-08T14-52.md
new file mode 100644
index 000000000..a5eb8dc64
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postcommit.2026-08-08T14-52.md
@@ -0,0 +1,135 @@
+# Phase 4 — Post-Commit Protected-Path and Scope Verification (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P4-T4]
+Post-commit HEAD: `00bc47bb2d9f82cc4b63b13fbfbd251627e858b1`
+
+## Command 1 — protected-path check, path-scoped
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD -- TaskMaster/AppGlobals/AppItemEngines.cs UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs TaskMaster/AppGlobals/ApplicationGlobals.cs"`
+EXIT_CODE: 0
+
+Output, verbatim:
+
+```text
+(no output)
+```
+
+The command produced **zero output lines**. A sentinel `---END-CMD1---` line was emitted after the exit-code line so the empty result is observed rather than inferred from absence.
+
+The diff is **path-scoped** (`-- <paths>`) precisely so the enclosing branch diff — which necessarily contains every implementation-cycle path — cannot mask a change to a protected file.
+
+**All three of `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, and `TaskMaster/AppGlobals/ApplicationGlobals.cs` are absent from the first output.** Each retains a zero-line diff against the merge-base in the committed tree, satisfying AC15 (R4) and the third path's implementation-cycle guarantee.
+
+## Command 2 — scope check over the remediation commit's own diff
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git show --numstat --format= HEAD"`
+EXIT_CODE: 0
+
+The scope check is taken over the **remediation commit's own diff**, not the whole-branch diff. The whole-branch diff necessarily contains every implementation-cycle path and would make an unscoped gate unsatisfiable.
+
+Output, verbatim (58 paths):
+
+```text
+1	1	.claude/agent-memory/atomic-executor/MEMORY.md
+6	2	.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
+1	0	.claude/agent-memory/atomic-planner/MEMORY.md
+19	0	.claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md
+3	0	.claude/agent-memory/feature-review/MEMORY.md
+20	0	.claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md
+20	0	.claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md
+1	1	.claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
+20	0	.claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md
+12	3	TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+53	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md
+48	0	docs/.../evidence/other/phase1-build-postrestore.2026-08-08T14-52.md
+45	0	docs/.../evidence/other/phase1-build-premutation.2026-08-08T14-52.md
+49	0	docs/.../evidence/other/phase2-build.2026-08-08T14-52.md
+70	0	docs/.../evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md
+31	0	docs/.../evidence/qa-gates/coverage-gate-artifact.2026-08-08T14-52.md
+47	0	docs/.../evidence/qa-gates/coverage-projection.2026-08-08T14-52.md
+39	0	docs/.../evidence/qa-gates/coverage-remediation-final.jacoco.xml
+51	0	docs/.../evidence/qa-gates/csharpier-check.2026-08-08T14-52.md
+42	0	docs/.../evidence/qa-gates/csharpier-format.2026-08-08T14-52.md
+93	0	docs/.../evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md
+41	0	docs/.../evidence/qa-gates/f2-xml-line-count.2026-08-08T14-52.md
+25	0	docs/.../evidence/qa-gates/f2-xml-wellformed.2026-08-08T14-52.md
+80	0	docs/.../evidence/qa-gates/file-size-audit.2026-08-08T14-52.md
+40	0	docs/.../evidence/qa-gates/manual-only-unchecked.2026-08-08T14-52.md
+36	0	docs/.../evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md
+32	0	docs/.../evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md
+113	0	docs/.../evidence/qa-gates/scope-lock-audit.2026-08-08T14-52.md
+67	0	docs/.../evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md
+57	0	docs/.../evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md
+32	0	docs/.../evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md
+78	0	docs/.../evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md
+70	0	docs/.../evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md
+39	0	docs/.../evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md
+46	0	docs/.../evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md
+50	0	docs/.../evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md
+32	0	docs/.../evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md
+46	0	docs/.../evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md
+48	0	docs/.../evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md
+96	0	docs/.../evidence/remediation-baseline/change-site-text.2026-08-08T14-52.md
+151	0	docs/.../evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md
+39	0	docs/.../evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml
+22	0	docs/.../evidence/remediation-baseline/csharpier-check.2026-08-08T14-52.md
+42	0	docs/.../evidence/remediation-baseline/embedded-ribbon-helper.2026-08-08T14-52.md
+43	0	docs/.../evidence/remediation-baseline/file-line-counts.2026-08-08T14-52.md
+41	0	docs/.../evidence/remediation-baseline/git-state.2026-08-08T14-52.md
+31	0	docs/.../evidence/remediation-baseline/msbuild-analyzers.2026-08-08T14-52.md
+30	0	docs/.../evidence/remediation-baseline/msbuild-nullable.2026-08-08T14-52.md
+48	0	docs/.../evidence/remediation-baseline/phase0-inputs-read.2026-08-08T14-52.md
+32	0	docs/.../evidence/remediation-baseline/phase0-instructions-read.2026-08-08T14-52.md
+31	0	docs/.../evidence/remediation-baseline/preexisting-failures.2026-08-08T14-52.md
+51	0	docs/.../evidence/remediation-baseline/tests-with-coverage.2026-08-08T14-52.md
+26	0	docs/.../evidence/remediation-baseline/toolchain-and-restore.2026-08-08T14-52.md
+92	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md
+225	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md
+53	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md
+330	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md
+12	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
+89	0	docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md
+```
+
+(The `docs/.../` elisions above abbreviate `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/` for readability; the numeric columns and filenames are verbatim.)
+
+## Bucket classification of every path in the commit diff
+
+### Bucket (a) — section 4.1 source path
+
+| Path | Numstat |
+|---|---|
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | `12  3` |
+
+Filtering the commit diff for source extensions outside the evidence tree returns **exactly this one path**:
+
+```text
+$ git show --numstat --format= HEAD | cut -f3 | grep -Ei '\.(cs|csproj|xml|sln)$' | grep -v '/evidence/'
+TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+```
+
+`TaskMaster/Ribbon/RibbonExplorer.xml` is **absent** from the commit — a zero-line diff — following the P2-T1 revert recorded in `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`. Absence is within the gate, which constrains which paths may be present, not which must be.
+
+### Bucket (b) — section 4.2 documentation and evidence paths
+
+All 45 paths under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`, including `spec.md` (`12  0` — append-only, **zero deleted**), `remediation-plan.2026-08-08T14-26.md` (checklist state), and every artifact under `evidence/`, regardless of extension. `evidence/qa-gates/coverage-remediation-final.jacoco.xml` and `evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml` are `.xml` paths but sit **inside** `<FEATURE>\evidence\`, so they are bucket (b) and outside the source-extension gate by its own terms.
+
+The nine `.claude/agent-memory/**` paths are section 4.2 permitted paths.
+
+### Bucket (c) — pre-existing uncommitted paths carried in from the review cycle
+
+`code-review.2026-08-08T14-15.md`, `feature-audit.2026-08-08T14-15.md`, `policy-audit.2026-08-08T14-15.md`, `remediation-inputs.2026-08-08T14-26.md`, `docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md`, and the nine `.claude/agent-memory/**` entries. Every one appears in the P0-T5 porcelain recorded in `evidence/remediation-baseline/git-state.2026-08-08T14-52.md`. This cycle neither created nor modified them; `git add -A` committed them as-is, exactly as plan section 4.2 anticipates.
+
+### Bucket (d) — violations
+
+**EMPTY.**
+
+## Binary outcome
+
+| Condition | Measured | Verdict |
+|---|---|---|
+| Command 1 output is empty | zero output lines | **PASS** |
+| In command 2, outside `<FEATURE>\evidence\` the only `.cs`/`.csproj`/`.xml`/`.sln` paths are `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` and `TaskMaster/Ribbon/RibbonExplorer.xml` | exactly one such path, `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | **PASS** |
+| No bucket (d) entry | 0 | **PASS** |
+| `spec.md` shows zero deleted lines | `12  0` | **PASS** |
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postformat.2026-08-08T14-59.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postformat.2026-08-08T14-59.md
new file mode 100644
index 000000000..2eb889205
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff-postformat.2026-08-08T14-59.md
@@ -0,0 +1,68 @@
+# AC15 Zero-Line Diff Re-Verification (Post-Format) — Issue #503 (P6-T10)
+
+Timestamp: 2026-08-08T14-59
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD"
+```
+
+Corroborating commands (the CSharpier format pass and the three nullable fixes are not yet committed at this point; P7-T32 commits them, so the working tree must be audited as well as the commit range):
+```
+git status --porcelain | grep -E "\.(cs|csproj|xml|sln)$"
+{ git diff --numstat <MERGE_BASE>..HEAD; git status --porcelain; } | grep -E "AppItemEngines\.cs|IAppItemEngines\.cs|ApplicationGlobals\.cs"
+```
+
+EXIT_CODE: 0
+
+## AC15 protected-path assertion
+
+The combined search over **both** the `<MERGE_BASE>..HEAD` diff **and** the uncommitted working tree returns **no lines** (grep exit 1) for any of the three protected paths:
+
+- `TaskMaster/AppGlobals/AppItemEngines.cs` — **absent from the diff and from the working tree**
+- `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs` — **absent from the diff and from the working tree**
+- `TaskMaster/AppGlobals/ApplicationGlobals.cs` — **absent from the diff and from the working tree**
+
+Each therefore still has a zero-line diff against the merge-base after the final CSharpier format pass. The section 3 rule 5 scope guard held: because `csharpier format` was never invoked repo-wide and never received either protected path in its argument list, the formatter could not have rewritten them.
+
+## Scope-lock assertion
+
+Non-documentation entries in `git diff --numstat <MERGE_BASE>..HEAD`:
+
+```
+116	0	TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+52	0	TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+344	0	TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+221	0	TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+148	0	TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+4	0	TaskMaster.Test/TaskMaster.Test.csproj
+89	0	TaskMaster/Ribbon/EngineCommandCatalog.cs
+58	0	TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+133	0	TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+103	0	TaskMaster/Ribbon/EngineReadinessGate.cs
+97	0	TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+23	3	TaskMaster/Ribbon/RibbonExplorer.xml
+202	0	TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+1	100	TaskMaster/Ribbon/RibbonViewer.cs
+6	0	TaskMaster/TaskMaster.csproj
+7	0	TaskMaster/ThisAddIn.cs
+```
+
+Uncommitted source modifications in the working tree (all produced by the P6-T1 format pass and the three P6-T5 nullable fixes; committed by P7-T32):
+
+```
+ M TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+ M TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+ M TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+ M TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+ M TaskMaster/Ribbon/EngineCommandCatalog.cs
+ M TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+ M TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+ M TaskMaster/Ribbon/EngineReadinessGate.cs
+ M TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+ M TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+```
+
+Every path appearing in either list is a member of the plan's section 4 scope lock. Every remaining path in the full `--numstat` output (omitted above for brevity, unchanged from the P5-T1 artifact) lies under `docs/features/` or `.claude/agent-memory/` — documentation and evidence, which are expected diff entries and are not source-scope violations.
+
+Binary outcome: **PASS** — the three protected paths are absent from both the commit range and the working tree, and no `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears in either.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-08.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-08.md
new file mode 100644
index 000000000..c21c9bd4d
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-08.md
@@ -0,0 +1,108 @@
+# AC15 Zero-Line Diff Verification — Issue #503 (P5-T1)
+
+Timestamp: 2026-08-08T14-08
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD"
+```
+
+EXIT_CODE: 0
+
+## Output Summary — full `--numstat` output
+
+```
+1	0	.claude/agent-memory/atomic-executor/MEMORY.md
+17	0	.claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
+3	0	.claude/agent-memory/atomic-planner/MEMORY.md
+12	0	.claude/agent-memory/atomic-planner/csharpier-repowide-format-breaks-zero-diff-acs.md
+18	0	.claude/agent-memory/atomic-planner/diff-gates-need-a-commit-task.md
+19	0	.claude/agent-memory/atomic-planner/project_503_ribbon_readiness_plan_seams.md
+8	0	.claude/agent-memory/atomic-planner/project_legacy_csproj_explicit_compile_include.md
+1	0	.claude/agent-memory/prd-feature/MEMORY.md
+12	0	.claude/agent-memory/prd-feature/feedback_full_bug_spec_only.md
+1	0	.claude/agent-memory/task-researcher/MEMORY.md
+25	0	.claude/agent-memory/task-researcher/project_ribbon_engine_readiness_503.md
+116	0	TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs
+52	0	TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs
+344	0	TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs
+221	0	TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs
+148	0	TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+4	0	TaskMaster.Test/TaskMaster.Test.csproj
+89	0	TaskMaster/Ribbon/EngineCommandCatalog.cs
+58	0	TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs
+133	0	TaskMaster/Ribbon/EngineGatedCommandRunner.cs
+103	0	TaskMaster/Ribbon/EngineReadinessGate.cs
+97	0	TaskMaster/Ribbon/RibbonController.EngineCommands.cs
+23	3	TaskMaster/Ribbon/RibbonExplorer.xml
+202	0	TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs
+1	100	TaskMaster/Ribbon/RibbonViewer.cs
+6	0	TaskMaster/TaskMaster.csproj
+7	0	TaskMaster/ThisAddIn.cs
+187115	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/coverage-baseline.cobertura.xml
+25	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-check.2026-08-08T13-08.md
+42	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/csharpier-scope-rule.2026-08-08T13-14.md
+44	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/file-line-counts.2026-08-08T13-13.md
+47	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/git-state.2026-08-08T13-06.md
+29	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-analyzers.2026-08-08T13-09.md
+21	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/msbuild-nullable.2026-08-08T13-10.md
+26	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/nuget-restore.2026-08-08T13-07.md
+23	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-commit.2026-08-08T13-15.md
+27	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-inputs-read.2026-08-08T13-05.md
+26	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/phase0-instructions-read.md
+33	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/preexisting-failures.2026-08-08T13-12.md
+50	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/tests-with-coverage.2026-08-08T13-11.md
+24	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/toolchain-availability.2026-08-08T13-01.md
+39	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase2-build.2026-08-08T13-30.md
+31	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/other/phase3-build.2026-08-08T13-48.md
+32	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-503.2026-08-08T13-22.md
+19	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-exception.2026-08-08T13-23.md
+41	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/pass-after-503.2026-08-08T13-32.md
+44	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/phase4-scoped-tests.2026-08-08T14-02.md
+84	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md
+378	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/plan.2026-08-08T11-59.md
+446	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md
+509	0	docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
+83	0	docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md
+85	0	docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md
+81	0	docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md
+83	0	docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md
+98	0	docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md
+```
+
+## AC15 protected-path assertion
+
+**None of the three protected paths appears anywhere in the output.** Each therefore has a zero-line diff against the merge-base:
+
+- `TaskMaster/AppGlobals/AppItemEngines.cs` — **absent**
+- `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs` — **absent**
+- `TaskMaster/AppGlobals/ApplicationGlobals.cs` — **absent**
+
+No `IsInitialized` / `InitTask` flag and no new `IAppItemEngines` member was introduced.
+
+## Scope-lock assertion
+
+Every path that appears is either a member of the plan's section 4 scope lock, or lies under `docs/features/` or `.claude/agent-memory/` (documentation and evidence, which are expected diff entries and are not source-scope violations).
+
+The 16 non-documentation paths, all in the scope lock:
+
+| Path | Category |
+|---|---|
+| `TaskMaster/Ribbon/EngineCommandCatalog.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/EngineReadinessGate.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/EngineGatedCommandRunner.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/RibbonController.EngineCommands.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs` | 4.1 new production |
+| `TaskMaster/Ribbon/RibbonViewer.cs` | 4.2 modified production |
+| `TaskMaster/Ribbon/RibbonExplorer.xml` | 4.2 modified production |
+| `TaskMaster/ThisAddIn.cs` | 4.2 modified production |
+| `TaskMaster/TaskMaster.csproj` | 4.2 modified production |
+| `TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs` | 4.3 new test |
+| `TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs` | 4.3 new test |
+| `TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs` | 4.3 new test |
+| `TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs` | 4.3 new test |
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | 4.3 modified test |
+| `TaskMaster.Test/TaskMaster.Test.csproj` | 4.3 modified test |
+
+Binary outcome: **PASS** — the three protected paths are absent, and no `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears. Note in particular that `TaskMaster/Ribbon/RibbonViewer.cs` shows `1 100` (one line added for `partial`, 100 lines removed by the region relocation), which is the expected net effect of the P3-T1/P3-T4 split.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md
new file mode 100644
index 000000000..2e72a6d8d
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/qa-gates/zero-line-diff.2026-08-08T14-52.md
@@ -0,0 +1,32 @@
+# Phase 3 QC Step 10 — AC15 Zero-Line Diff (Working Tree) (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P3-T10]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2 -- TaskMaster/AppGlobals/AppItemEngines.cs UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs TaskMaster/AppGlobals/ApplicationGlobals.cs"`
+EXIT_CODE: 0
+
+## Why this form of the command
+
+The diff is expressed as `git diff --numstat <MERGE_BASE> -- <paths>` **without** `..HEAD`. That form compares the **working tree** against the merge-base, so an uncommitted edit to a protected file is caught **before** the commit rather than after. A `<MERGE_BASE>..HEAD` diff would compare two commits and would miss an uncommitted change entirely. P4-T4 repeats the check in path-scoped `<MERGE_BASE>..HEAD -- <paths>` form once the commit exists.
+
+## Output Summary
+
+```text
+(no output)
+```
+
+The command produced **zero output lines** between its invocation and the `EXIT_CODE=0` marker. A sentinel `---END---` line was emitted after the exit-code line to make the empty result unambiguous rather than inferred from absence.
+
+An empty `git diff --numstat` result means **none of the three named paths differs from the merge-base** in the working tree.
+
+## Protected paths verified
+
+| Path | Bound by | Working-tree diff vs `003c5715` |
+|---|---|---|
+| `TaskMaster/AppGlobals/AppItemEngines.cs` | **AC15** (R4) | **none** |
+| `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs` | **AC15** (R4) | **none** |
+| `TaskMaster/AppGlobals/ApplicationGlobals.cs` | zero-line diff in the implementation cycle; verified alongside | **none** |
+
+This cycle touched none of the three. The only source path it modifies is `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, and it never invoked `csharpier format` repo-wide, which is what could otherwise have reformatted a protected file silently (plan section 3 rule 5).
+
+Binary outcome satisfied: the output is **empty** — none of the three protected paths differs from the merge-base.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md
new file mode 100644
index 000000000..8e7543e72
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md
@@ -0,0 +1,78 @@
+# F1 — Post-Change Assertion Shape and Three-Condition Non-Vacuity Argument (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T2]
+Command: Source inspection of `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` lines 176-216, plus `git diff -- TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` to confirm the change is confined to one method
+EXIT_CODE: 0
+
+This artifact records the **source-inspection** half of the F1 proof. The **executable** half — a recorded failing run against a deliberately mutated embedded resource — is P1-T7 (`f1-fail-proof.2026-08-08T14-52.md`), with restoration at P1-T8 and the pass-after state at P1-T10. Source inspection alone is not accepted as the proof; it is the argument the executable proof then confirms.
+
+## Post-change method body, verbatim
+
+```csharp
+        [TestMethod]
+        public void RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback()
+        {
+            // Arrange
+            var document = LoadRibbonDocument();
+
+            // Act: index every element that carries an id.
+            var elementsById = document
+                .Descendants()
+                .Where(element => element.Attribute("id") != null)
+                .ToDictionary(element => element.Attribute("id")!.Value, element => element);
+
+            // Assert
+            foreach (var controlId in EngineCommandCatalog.ControlIds)
+            {
+                elementsById
+                    .Should()
+                    .ContainKey(
+                        controlId,
+                        "the catalog control id '{0}' must exist in the ribbon XML",
+                        controlId
+                    );
+                // Bind the attribute first. A null-conditional dereference here would
+                // short-circuit the whole assertion chain, including .Should(), so the
+                // test would pass silently on the exact regression it exists to catch.
+                var getEnabled = elementsById[controlId].Attribute("getEnabled");
+                getEnabled
+                    .Should()
+                    .NotBeNull(
+                        "control '{0}' is engine-backed and must declare a getEnabled callback",
+                        controlId
+                    );
+                getEnabled!
+                    .Value.Should()
+                    .Be(
+                        EngineCommandGetEnabledCallback,
+                        "control '{0}' is engine-backed and must be disabled until its engine loads",
+                        controlId
+                    );
+            }
+        }
+```
+
+## Output Summary — the three required failure conditions
+
+`remediation-inputs.2026-08-08T14-26.md` §F1 requires the assertion to fail when the attribute is missing, when it is present with the wrong value, and when it is present but empty. Each condition is mapped to the specific assertion line that fails for it:
+
+| # | Condition | Failing assertion line | Mechanism |
+|---|---|---|---|
+| 1 | Attribute **absent** | `getEnabled.Should().NotBeNull("control '{0}' is engine-backed and must declare a getEnabled callback", controlId)` | `XElement.Attribute("getEnabled")` returns `null`. The result is bound to a local **before** any dereference, so no `?.` short-circuits the chain. `NotBeNull` is invoked on the null reference through the `ObjectAssertions` extension and fails with a message naming the control id. This is the condition the pre-change form could not detect. |
+| 2 | Attribute present with the **wrong value** | `getEnabled!.Value.Should().Be(EngineCommandGetEnabledCallback, ...)` | The attribute is non-null so condition 1 passes; `Value` returns the wrong string and `Be` fails on string inequality. |
+| 3 | Attribute present but **empty** | `getEnabled!.Value.Should().Be(EngineCommandGetEnabledCallback, ...)` | The attribute is non-null so condition 1 passes; `Value` returns `""`, which is not `"EngineCommand_GetEnabled"`, and `Be` fails on string inequality. |
+
+The null-forgiving `!` on line `getEnabled!` is a compiler-flow annotation only. It suppresses a nullable-flow warning at the dereference site; it does not suppress a runtime failure and it does not short-circuit. If control reached that line with a null `getEnabled`, the preceding `NotBeNull` assertion would already have failed and thrown, so the dereference is unreachable in the null case.
+
+## Structural verification performed
+
+- **Zero `?.` occurrences** in the method body (lines 170-216), verified by `sed -n '170,216p' ... | grep -c '?\.'` returning 0.
+- Both required shapes present: `.Should().NotBeNull(` and `.Value.Should()` ... `.Be(`.
+- The `ContainKey` assertion above the change is **unchanged**.
+- `git diff --numstat` reports `12 3` for the file — a single hunk, entirely inside this one method.
+- `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` (the AC6 sibling test) is **byte-identical** to its pre-change text; it does not appear in the diff. Its use of `?.Value ==` sits inside a LINQ predicate where null-means-no-match is the intended semantics, so it is correct as written and must remain.
+- No other member of the file changed.
+- File size after the change: **318 physical lines**, under the 500-line cap.
+
+Binary outcome satisfied: all three conditions are mapped to a named assertion line.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md
new file mode 100644
index 000000000..749530694
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md
@@ -0,0 +1,70 @@
+# F1 — Recorded Fail-Proof: the Corrected Assertion Fails on the Mutated Resource (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T7] **[expect-fail]**
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.RibbonExplorerXmlTests'"`
+EXIT_CODE: **1**
+
+A **non-zero** exit code is the expected and required outcome of this task, and of this task only. It is the executable half of the F1 proof: it demonstrates that the corrected assertion genuinely fails on the condition it names, rather than merely appearing to assert it.
+
+## Proof that the assembly under test carried the mutation
+
+Cross-reference: `evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md` records `EMBEDDED_GETENABLED_COUNT=7` read directly out of `TaskMaster.Test\bin\Debug\TaskMaster.dll`, with `EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:04:58.9399552Z` advancing past the pre-mutation value `2026-08-08T18:57:19.8234515Z`. The failure recorded below therefore cannot be attributed to a stale assembly; the resource the test read was the mutated one.
+
+Control: `evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md` records the identical command passing 8/8 against the same corrected test with the **unmutated** resource. The failure is attributable to the mutation, not to the P1-T1 edit.
+
+## Output Summary
+
+```text
+Test Run Failed.
+Total tests: 8
+     Passed: 6
+     Failed: 2
+```
+
+| Metric | Value |
+|---|---|
+| Total | 8 |
+| Passed | 6 |
+| **Failed** | **2** |
+
+### The AC5 test — reported Failed
+
+`RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` is reported **Failed**. Verbatim failure message, isolated by re-running the single test under `/TestCaseFilter:'FullyQualifiedName=...'`:
+
+```text
+  Failed RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback [166 ms]
+  Error Message:
+   Expected getEnabled not to be <null> because control 'TrainSpam' is engine-backed and must declare a getEnabled callback.
+  Stack Trace:
+     at FluentAssertions.Execution.LateBoundTestFramework.Throw(String message) in /_/Src/FluentAssertions/Execution/LateBoundTestFramework.cs:line 22
+   at FluentAssertions.Execution.AssertionChain.FailWith(Func`1 getFailureReason) in /_/Src/FluentAssertions/Execution/AssertionChain.cs:line 277
+   at FluentAssertions.Primitives.ReferenceTypeAssertions`2.NotBeNull(String because, Object[] becauseArgs) in /_/Src/FluentAssertions/Primitives/ReferenceTypeAssertions.cs:line 71
+   at TaskMaster.Test.Ribbon.RibbonExplorerXmlTests.RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback() in C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs:line 202
+```
+
+The stack frame names `ReferenceTypeAssertions.NotBeNull` at `RibbonExplorerXmlTests.cs:line 202` — the exact assertion introduced by P1-T1. The failure message carries the `because` reason naming the specific control (`TrainSpam`), so the diagnostic identifies which of the eight controls regressed.
+
+This is decisive. **Before** the P1-T1 change, the identical mutation would have produced a silent pass: `Attribute("getEnabled")` returns `null`, the `?.` short-circuits the entire chain including `.Should()`, and no assertion executes. The test is now non-vacuous on condition 1 of the three required conditions, and conditions 2 and 3 (wrong value, empty value) both route through `getEnabled!.Value.Should().Be(...)`, which is reached unconditionally once the attribute is present.
+
+### Other test that failed as a consequence of the same mutation
+
+`RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` (the AC6 sibling set-equality test) also failed:
+
+```text
+  Failed RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls [66 ms]
+  Error Message:
+   Expected declaringIds to contain exactly 8 items in any order because only the engine-backed controls may be disabled by the readiness callback, but it misses {"TrainSpam"}
+```
+
+This failure is **expected and correct**. That test was already non-vacuous before this cycle — it is the criterion that kept AC5 genuinely enforced while the AC5 test itself was vacuous, as recorded in `code-review.2026-08-08T14-15.md`. Its failure here confirms the mutation reached the assembly through a second independent route.
+
+### Tests that passed
+
+`RibbonExplorerXml_IsWellFormedXml`, `RibbonExplorerXml_MenusContainOnlyMenuLegalControls`, `RibbonExplorerXml_TaskMasterGroupsLiveUnderTaskmasterTab`, `RibbonExplorerXml_TabMailCarriesNoCustomGroup`, `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled`, and `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` all passed. None of them asserts the presence of the attribute, so none is sensitive to this mutation. That is the correct blast radius.
+
+## Restoration
+
+The mutation is restored by P1-T8 (`f1-mutation-restored.2026-08-08T14-52.md`). The permanent tree retains no part of it.
+
+Binary outcome satisfied: `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` is reported **Failed**, with a non-zero exit code and a verbatim failure message naming the `NotBeNull` assertion at line 202.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md
new file mode 100644
index 000000000..a651f98e9
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md
@@ -0,0 +1,39 @@
+# F1 — Corrected Assertion Green Before the Mutation (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T4]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.RibbonExplorerXmlTests'"`
+EXIT_CODE: 0
+
+This run establishes that the corrected assertion is **green against the unmutated resource**, which is the necessary control for the P1-T7 fail-proof. Without it, a failure at P1-T7 could not be attributed to the mutation rather than to the P1-T1 edit itself.
+
+## Output Summary
+
+```text
+  Passed RibbonExplorerXml_IsWellFormedXml [62 ms]
+  Passed RibbonExplorerXml_MenusContainOnlyMenuLegalControls [9 ms]
+  Passed RibbonExplorerXml_TaskMasterGroupsLiveUnderTaskmasterTab [9 ms]
+  Passed RibbonExplorerXml_TabMailCarriesNoCustomGroup [2 ms]
+  Passed RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback [11 ms]
+  Passed RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls [56 ms]
+  Passed RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled [< 1 ms]
+  Passed RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer [2 ms]
+
+Test Run Successful.
+Total tests: 8
+     Passed: 8
+ Total time: 3.0785 Seconds
+```
+
+| Metric | Value |
+|---|---|
+| Total | 8 |
+| Passed | 8 |
+| Failed | **0** |
+| Skipped | **0** |
+
+`RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` — the method changed by P1-T1 — is reported **Passed**.
+
+The assembly under test is the one built by P1-T3, whose embedded resource was asserted to carry `EMBEDDED_GETENABLED_COUNT=8` in `evidence/other/phase1-build-premutation.2026-08-08T14-52.md`.
+
+Binary outcome satisfied: `EXIT_CODE: 0` with zero failed and zero skipped.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md
new file mode 100644
index 000000000..4c42e0246
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md
@@ -0,0 +1,46 @@
+# F1 — Mutated Resource Confirmed Embedded in the Assembly Under Test (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T6]
+
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'"`
+EXIT_CODE: 0
+
+Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`
+EXIT_CODE: 0
+
+## Why this task is a hard gate, not an implementation detail
+
+`RibbonExplorer.xml` is an **embedded resource**. `RibbonExplorerXmlTests` reads it through `assembly.GetManifestResourceStream("TaskMaster.Ribbon.RibbonExplorer.xml")` on the `TaskMaster.dll` copied into `TaskMaster.Test\bin\Debug\`. Editing the `.xml` on disk is invisible to the test until the assembly is rebuilt and re-copied.
+
+Without this gate, an edit-then-run sequence would read a stale assembly still carrying eight attributes, the test would report **Passed**, and the fail-proof would be silently converted into a second vacuous check — proving nothing while appearing to prove everything. Asserting the embedded byte content **before** the failing run is attempted is the only way to distinguish "the assertion cannot fail" from "the assembly was stale".
+
+## Output Summary
+
+### Build
+
+```text
+    6 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:08.23
+```
+
+Zero errors. Six warnings: the five pre-existing `System.Reactive` packages.config advisories plus the pre-existing `CS2002` duplicate-compile warning in `UtilitiesCS.Test.csproj` (issue **#510**, out of scope). Both were present in the P0-T9 baseline.
+
+### Embedded-content assertion
+
+```text
+EMBEDDED_GETENABLED_COUNT=7
+EMBEDDED_TRIAGESETA_SINGLELINE=False
+EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:04:58.9399552Z
+```
+
+- **`EMBEDDED_GETENABLED_COUNT=7`** — the gate condition. The assembly the test will read carries **seven** `getEnabled="EngineCommand_GetEnabled"` attributes, down from eight. The `TrainSpam` attribute deleted by P1-T5 is genuinely absent from the assembly under test.
+- `EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T19:04:58.9399552Z` — later than the pre-mutation value `2026-08-08T18:57:19.8234515Z` recorded in `evidence/other/phase1-build-premutation.2026-08-08T14-52.md`, confirming the assembly was rewritten by this build rather than left stale.
+
+### `/t:Rebuild` fallback
+
+**Not required.** MSBuild's incremental resource check picked up the `.xml` edit on the ordinary `/t:Build` invocation, as evidenced by the count dropping to 7 and the assembly write time advancing. The `msbuild TaskMaster\TaskMaster.csproj /t:Rebuild ...` fallback specified by the task text was therefore not executed, and no second build invocation is recorded.
+
+Binary outcome satisfied: the helper reports `EMBEDDED_GETENABLED_COUNT=7`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md
new file mode 100644
index 000000000..2d4f0837f
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-applied.2026-08-08T14-52.md
@@ -0,0 +1,50 @@
+# F1 — Temporary Mutation Applied (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T5]
+
+Edit: deleted exactly line 103 of `TaskMaster\Ribbon\RibbonExplorer.xml` — the `getEnabled="EngineCommand_GetEnabled"` attribute line inside the `<button id="TrainSpam" ...>` element that spans lines 99-105. Nothing else was changed.
+
+Command (verification): `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=\"EngineCommand_GetEnabled\"' -AllMatches | Measure-Object).Count; (Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' | Measure-Object -Line).Lines; git diff --numstat -- TaskMaster/Ribbon/RibbonExplorer.xml"`
+EXIT_CODE: 0
+
+## THIS MUTATION IS TEMPORARY AND MUST NEVER BE COMMITTED
+
+Plan section 3 rule 8 governs this window. P1-T8 restores the file with `git checkout --` and is its own verified task. **If execution halts for any reason before P1-T8 completes, the first action on resume is to run P1-T8.** No commit task may execute while this mutation is present; the Phase 4 commit (P4-T3) is gated on the P1-T8 restoration artifact recording an empty porcelain for this path.
+
+## Output Summary
+
+```text
+7
+538
+0	1	TaskMaster/Ribbon/RibbonExplorer.xml
+```
+
+| Measurement | Value | Expected |
+|---|---|---|
+| `getEnabled="EngineCommand_GetEnabled"` occurrences | **7** | 7 |
+| Line count | **538** | 538 |
+| `git diff --numstat` added / deleted | **0 / 1** | 0 / 1 |
+
+`wc -l` independently corroborates 538 physical lines. `RibbonExplorer.xml` contains no blank lines, so the two counting methods agree.
+
+## Verbatim diff
+
+```diff
+diff --git a/TaskMaster/Ribbon/RibbonExplorer.xml b/TaskMaster/Ribbon/RibbonExplorer.xml
+index 9d8403ee..6b2ee03d 100644
+--- a/TaskMaster/Ribbon/RibbonExplorer.xml
++++ b/TaskMaster/Ribbon/RibbonExplorer.xml
+@@ -100,7 +100,6 @@
+             id="TrainSpam"
+             imageMso="CancelAll"
+             onAction="TrainSpam_Click"
+-            getEnabled="EngineCommand_GetEnabled"
+             label="Train Spam"
+           />
+           <button
+```
+
+Exactly one deleted line, zero added lines, one hunk. The `TrainSpam` element was chosen because it was already in multi-line form, so the deletion needs no re-indentation, and because it sits in `<group id="SpamBayesGroup">` rather than the `<group id="TriageGroup">` the F2 edit touches, keeping the two changes disentangled.
+
+Binary outcome satisfied: 7 occurrences, 538 lines, `git diff --numstat` reports `0` added and `1` deleted.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md
new file mode 100644
index 000000000..b78193131
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md
@@ -0,0 +1,32 @@
+# F1 — Temporary Mutation Restored (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T8]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git checkout -- TaskMaster/Ribbon/RibbonExplorer.xml; git status --porcelain -- TaskMaster/Ribbon/RibbonExplorer.xml; (Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' | Measure-Object -Line).Lines; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=\"EngineCommand_GetEnabled\"' -AllMatches | Measure-Object).Count"`
+EXIT_CODE: 0
+
+## Why `git checkout --` is the restoration mechanism
+
+It is exact and deterministic. Phase 1 made no other change to `RibbonExplorer.xml`, and Phase 2 has not yet run, so restoring the path from the index reproduces the pre-mutation bytes without any opportunity to introduce a whitespace, ordering, or encoding difference. Hand re-insertion of the deleted line would be a second opportunity for exactly that class of error.
+
+## Output Summary
+
+```text
+539
+8
+EXIT_CODE=0
+```
+
+| Measurement | Value | Required |
+|---|---|---|
+| `git status --porcelain -- TaskMaster/Ribbon/RibbonExplorer.xml` | **(empty — no output line)** | empty |
+| Line count | **539** | 539 |
+| `getEnabled="EngineCommand_GetEnabled"` occurrences | **8** | 8 |
+
+The porcelain query emitted **no output line** for the path. Its absence between the command invocation and the `539` line count is the empty result: git reports nothing for a path that matches HEAD. The file is byte-identical to its pre-mutation state.
+
+## Mutation window closed
+
+The window opened by P1-T5 and governed by plan section 3 rule 8 is now **closed**. The permanent tree retains no part of the mutation. The Phase 4 commit gate (P4-T3) — which may execute only after this artifact records an empty porcelain for `TaskMaster/Ribbon/RibbonExplorer.xml` — is satisfied by this record.
+
+Binary outcome satisfied on all three conditions: empty porcelain, 539 lines, 8 occurrences.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md
new file mode 100644
index 000000000..22d3bb1aa
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md
@@ -0,0 +1,46 @@
+# F1 — Pass-After-Restore (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P1-T10]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.RibbonExplorerXmlTests'"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+  Passed RibbonExplorerXml_IsWellFormedXml [50 ms]
+  Passed RibbonExplorerXml_MenusContainOnlyMenuLegalControls [7 ms]
+  Passed RibbonExplorerXml_TaskMasterGroupsLiveUnderTaskmasterTab [7 ms]
+  Passed RibbonExplorerXml_TabMailCarriesNoCustomGroup [1 ms]
+  Passed RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback [9 ms]
+  Passed RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls [47 ms]
+  Passed RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled [< 1 ms]
+  Passed RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer [2 ms]
+
+Test Run Successful.
+Total tests: 8
+     Passed: 8
+ Total time: 2.7982 Seconds
+```
+
+| Metric | Value |
+|---|---|
+| Total | 8 |
+| Passed | 8 |
+| Failed | **0** |
+| Skipped | **0** |
+
+`RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` is reported **Passed**. `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` — the AC6 sibling that also failed under the mutation — is likewise back to **Passed**.
+
+## The fail-then-pass pair
+
+| Stage | Artifact | Embedded count | AC5 test | Exit |
+|---|---|---|---|---|
+| Green before mutation | `evidence/regression-testing/f1-green-before-mutation.2026-08-08T14-52.md` | 8 | Passed | 0 |
+| **Fail with mutation** | **`evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md`** | **7** | **Failed** | **1** |
+| Restored | `evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md` | 8 (on disk) | — | 0 |
+| **Pass after restore** | this artifact | 8 | Passed | 0 |
+
+The pair proves the corrected assertion is non-vacuous: the same command, the same test, and the same corrected source produce a **Failure** when and only when the `getEnabled` attribute is absent from the resource the test actually reads. Before the P1-T1 change, the identical mutation produced a silent pass.
+
+Binary outcome satisfied: `EXIT_CODE: 0` with zero failed and zero skipped.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md
new file mode 100644
index 000000000..d8809c77f
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/f2-ribbon-xml-tests.2026-08-08T14-52.md
@@ -0,0 +1,48 @@
+# F2 — Ribbon-XML Regression Suite Against the Collapsed Resource (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P2-T5]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.RibbonExplorerXmlTests'"`
+EXIT_CODE: 0
+
+The assembly under test is the one built by P2-T4, whose embedded resource was asserted to carry `EMBEDDED_GETENABLED_COUNT=8` and `EMBEDDED_TRIAGESETA_SINGLELINE=True` in `evidence/other/phase2-build.2026-08-08T14-52.md`.
+
+## Output Summary
+
+```text
+  Passed RibbonExplorerXml_IsWellFormedXml [59 ms]
+  Passed RibbonExplorerXml_MenusContainOnlyMenuLegalControls [9 ms]
+  Passed RibbonExplorerXml_TaskMasterGroupsLiveUnderTaskmasterTab [7 ms]
+  Passed RibbonExplorerXml_TabMailCarriesNoCustomGroup [2 ms]
+  Passed RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback [10 ms]
+  Passed RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls [50 ms]
+  Passed RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled [< 1 ms]
+  Passed RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer [2 ms]
+
+Test Run Successful.
+Total tests: 8
+     Passed: 8
+ Total time: 2.9839 Seconds
+```
+
+| Metric | Value |
+|---|---|
+| Total | 8 |
+| Passed | 8 |
+| Failed | **0** |
+| Skipped | **0** |
+
+## The four acceptance-criterion tests named by the task
+
+| Criterion | Test | Result |
+|---|---|---|
+| **AC5** | `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` | **Passed** |
+| **AC6** | `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` | **Passed** |
+| **AC7** | `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` | **Passed** |
+| **AC8** | `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` | **Passed** |
+
+AC5 is now enforced by the **corrected, proven-non-vacuous** assertion from P1-T1, not by the short-circuiting form the review flagged. AC6 continues to enforce set equality independently. AC7 confirms every catalog id still resolves to a `<button>` element, which the collapse preserved. AC8 is a reflection assertion on `RibbonViewer` and is unaffected by the XML layout.
+
+The four other tests in the class (`IsWellFormedXml`, `MenusContainOnlyMenuLegalControls`, `TaskMasterGroupsLiveUnderTaskmasterTab`, `TabMailCarriesNoCustomGroup`) also pass, confirming the collapse broke no structural invariant of the document.
+
+Binary outcome satisfied: `EXIT_CODE: 0` with zero failed and zero skipped.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-503.2026-08-08T13-22.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-503.2026-08-08T13-22.md
new file mode 100644
index 000000000..728e1fbd2
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-503.2026-08-08T13-22.md
@@ -0,0 +1,32 @@
+# Fail-Before (Red) Evidence — Issue #503 (P1-T2) `[expect-fail]`
+
+Timestamp: 2026-08-08T13-22
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: **1** (non-zero — this is the expected outcome for this `[expect-fail]` task)
+
+## Output Summary — verbatim compiler diagnostics
+
+```
+Build FAILED.
+
+C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs(46,28): error CS0246: The type or namespace name 'EngineReadinessGate' could not be found (are you missing a using directive or an assembly reference?) [C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\TaskMaster.Test.csproj]
+C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs(47,30): error CS0246: The type or namespace name 'EngineGatedCommandRunner' could not be found (are you missing a using directive or an assembly reference?) [C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\TaskMaster.Test.csproj]
+C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs(81,28): error CS0246: The type or namespace name 'EngineReadinessGate' could not be found (are you missing a using directive or an assembly reference?) [C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\TaskMaster.Test.csproj]
+C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs(82,30): error CS0246: The type or namespace name 'EngineGatedCommandRunner' could not be found (are you missing a using directive or an assembly reference?) [C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\TaskMaster.Test.csproj]
+
+    5 Warning(s)
+    4 Error(s)
+```
+
+## Binary outcome
+
+**PASS (red proven).** The build exits non-zero, and every one of the four errors is a `CS0246` sourced from `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` naming exactly the two guard types that do not exist at the merge-base: `EngineReadinessGate` and `EngineGatedCommandRunner`. The 5 warnings are the pre-existing System.Reactive `packages.config` notices recorded in the P0-T7 baseline. No other error of any kind appears, so the non-zero exit is caused solely by the absence of the guard types.
+
+## Execution note
+
+The first execution of this task's command produced only **one** diagnostic (`CS0246` for `EngineReadinessGate` at the signature of a private helper method), because Roslyn does not bind method bodies once a declaration signature fails to bind, and `EngineGatedCommandRunner` appeared only in method bodies. The helper's signature was therefore changed from `private static EngineReadinessGate CreateGateOver(...)` to `private static Func<IAppItemEngines> CreateEnginesAccessor(...)`, moving both guard-type references into method bodies. Both types now bind in the same phase and both required diagnostics surface. The two `[TestMethod]` members, their names, their arrangements, and their assertions are unchanged by that edit.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-exception.2026-08-08T13-23.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-exception.2026-08-08T13-23.md
new file mode 100644
index 000000000..087d9d392
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/fail-before-exception.2026-08-08T13-23.md
@@ -0,0 +1,19 @@
+# Fail-Before Exception Dossier — Issue #503 (P1-T3)
+
+Timestamp: 2026-08-08T13-23
+
+## WhyFailingRunImpossible
+
+A runtime (non-compile) red is structurally impossible for #503 because the defective production path lives entirely inside `[ExcludeFromCodeCoverage]`, COM-bound `RibbonViewer` handlers that require a live `Office.IRibbonControl` supplied by a running Outlook host, and those handlers route the engine dereference through `RibbonController.SB` / `RibbonController.Triage`, whose getters install a real `WindowsFormsSynchronizationContext` on the calling thread as a side effect and are therefore prohibited by the spec's `## Test Strategy` ("Tests must not reach the readiness decision through `RibbonController.SB`/`Triage`/`TriageAsync`"). The unit under test, `EngineGatedCommandRunner`, does not exist at the merge-base, so the only observable red that a deterministic automated gate can produce is a compile-time red.
+
+## Search record
+
+- SearchScope: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\regression-testing\`
+- SearchPatterns: `fail-before-*.md`
+- SearchResult: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\regression-testing\fail-before-503.2026-08-08T13-22.md`
+
+## Alternative proof
+
+The P1-T2 artifact `fail-before-503.2026-08-08T13-22.md` records a non-zero build exit (`EXIT_CODE: 1`) whose entire error set is four `CS0246` diagnostics naming `EngineReadinessGate` and `EngineGatedCommandRunner`, sourced from `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs`. That is an absence-of-implementation proof: the two AC11 regression tests are authored, wired into `TaskMaster.Test.csproj`, and cannot compile at the merge-base precisely because the guard they exercise does not exist. The corresponding green is proven by P2-T6 (`pass-after-503.<TS>.md`), which runs the same two test methods to `Passed` after the four decision types are created.
+
+EXIT_CODE: 0
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/pass-after-503.2026-08-08T13-32.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/pass-after-503.2026-08-08T13-32.md
new file mode 100644
index 000000000..97423abcd
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/pass-after-503.2026-08-08T13-32.md
@@ -0,0 +1,41 @@
+# Pass-After (Green) Evidence — Issue #503 (P2-T6)
+
+Timestamp: 2026-08-08T13-32
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.EngineGatedCommandRunnerTests'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+EXIT_CODE: 0
+
+## Output Summary
+
+```
+VSTest version 18.8.0 (x64)
+
+Starting test execution, please wait...
+A total of 1 test files matched the specified pattern.
+  Passed RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException [151 ms]
+  Passed RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException [< 1 ms]
+
+Test Run Successful.
+Total tests: 2
+     Passed: 2
+ Total time: 1.5038 Seconds
+```
+
+| Test | Result |
+|---|---|
+| `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` | **Passed** |
+| `RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException` | **Passed** |
+
+Totals: 2 total, **2 passed, 0 failed, 0 skipped**.
+
+## Fail-before cross-reference
+
+Corresponding red: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\regression-testing\fail-before-503.2026-08-08T13-22.md` (EXIT_CODE 1; four `CS0246` diagnostics naming `EngineReadinessGate` and `EngineGatedCommandRunner`).
+
+Fail-before exception dossier: `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\regression-testing\fail-before-exception.2026-08-08T13-23.md`
+
+The red-to-green transition is caused solely by the creation of the four Phase 2 decision types; no test assertion was weakened between the two runs.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/phase4-scoped-tests.2026-08-08T14-02.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/phase4-scoped-tests.2026-08-08T14-02.md
new file mode 100644
index 000000000..158ed2888
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/regression-testing/phase4-scoped-tests.2026-08-08T14-02.md
@@ -0,0 +1,44 @@
+# Phase 4 Scoped Ribbon Test Run — Issue #503 (P4-T6)
+
+Timestamp: 2026-08-08T14-02
+
+Command:
+```
+pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""
+```
+
+The solution was rebuilt immediately before this run (see the Phase 4 build logs), so no edit post-dates the tested binary.
+
+EXIT_CODE: 0
+
+## Output Summary
+
+| Metric | Value |
+|---|---|
+| Result | `Test Run Successful.` |
+| Total tests | **69** |
+| Passed | **69** |
+| Failed | **0** |
+| Skipped | **0** |
+| Total time | 2.3365 seconds |
+
+New test classes exercised in this run:
+
+| Class | `[TestMethod]` / `[DataTestMethod]` members |
+|---|---|
+| `TaskMaster.Test.Ribbon.EngineGatedCommandRunnerTests` | 13 |
+| `TaskMaster.Test.Ribbon.EngineReadinessGateTests` | 11 |
+| `TaskMaster.Test.Ribbon.EngineCommandCatalogTests` | 6 |
+| `TaskMaster.Test.Ribbon.EngineCommandRefreshPlannerTests` | 2 |
+| `TaskMaster.Test.Ribbon.RibbonExplorerXmlTests` | 8 (4 pre-existing + 4 added for #503) |
+
+The four new `RibbonExplorerXmlTests` members all pass:
+
+```
+  Passed RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback [7 ms]
+  Passed RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls [5 ms]
+  Passed RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled [< 1 ms]
+  Passed RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer [1 ms]
+```
+
+Binary outcome: **PASS** — zero failed and zero skipped.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/change-site-text.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/change-site-text.2026-08-08T14-52.md
new file mode 100644
index 000000000..6b41c5152
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/change-site-text.2026-08-08T14-52.md
@@ -0,0 +1,96 @@
+# Phase 0 — Verbatim Pre-Remediation Text of Both Change Sites (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T7]
+Command: Read tool inspection of `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` lines 180-207 and `TaskMaster\Ribbon\RibbonExplorer.xml` lines 440-474 and 96-113
+EXIT_CODE: 0
+
+## Change site 1 — F1
+
+`C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, method `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback`, lines 180-207, quoted verbatim with line numbers:
+
+```csharp
+180	            var document = LoadRibbonDocument();
+181	
+182	            // Act: index every element that carries an id.
+183	            var elementsById = document
+184	                .Descendants()
+185	                .Where(element => element.Attribute("id") != null)
+186	                .ToDictionary(element => element.Attribute("id")!.Value, element => element);
+187	
+188	            // Assert
+189	            foreach (var controlId in EngineCommandCatalog.ControlIds)
+190	            {
+191	                elementsById
+192	                    .Should()
+193	                    .ContainKey(
+194	                        controlId,
+195	                        "the catalog control id '{0}' must exist in the ribbon XML",
+196	                        controlId
+197	                    );
+198	                elementsById[controlId]
+199	                    .Attribute("getEnabled")
+200	                    ?.Value.Should()
+201	                    .Be(
+202	                        EngineCommandGetEnabledCallback,
+203	                        "control '{0}' is engine-backed and must be disabled until its engine loads",
+204	                        controlId
+205	                    );
+206	            }
+207	        }
+```
+
+The defective sequence is visible at lines 198-200: `elementsById[controlId].Attribute("getEnabled")?.Value.Should()`. The null-conditional operator at line 200 short-circuits the entire remaining chain — including the `.Should()` call and the `.Be(...)` assertion — whenever `Attribute("getEnabled")` returns `null`. This is exactly the condition the test exists to detect, so today the test passes silently on the regression it names.
+
+The `ContainKey` assertion at lines 191-197 is correct and is not part of the F1 change; P1-T1 leaves it unchanged.
+
+## Sibling test that must remain unchanged
+
+`RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` at lines 215-236 uses `element.Attribute("getEnabled")?.Value == EngineCommandGetEnabledCallback` at line 224. That `?.` sits **inside a LINQ predicate**, where null-means-no-match is the intended semantics, so the construct is correct there. This test independently enforces AC5 by set equality and must be byte-identical after P1-T1.
+
+## Change site 2 — F2
+
+`C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\TaskMaster\Ribbon\RibbonExplorer.xml`, the three `TriageSet*` `<button>` elements inside `<group id="TriageGroup" ...>`, lines 447-466 quoted verbatim with line numbers (the enclosing `group` open tag at 447 and the following `menu` open tag at 466 are shown for boundary context and are **not** modified):
+
+```xml
+447	        <group id="TriageGroup" imageMso="Filter" label="Triage">
+448	          <button
+449	            id="TriageSetA"
+450	            onAction="TriageSetA_Click"
+451	            getEnabled="EngineCommand_GetEnabled"
+452	            label="Set A"
+453	          />
+454	          <button
+455	            id="TriageSetB"
+456	            onAction="TriageSetB_Click"
+457	            getEnabled="EngineCommand_GetEnabled"
+458	            label="Set B"
+459	          />
+460	          <button
+461	            id="TriageSetC"
+462	            onAction="TriageSetC_Click"
+463	            getEnabled="EngineCommand_GetEnabled"
+464	            label="Set C"
+465	          />
+466	          <menu id="OtherTriageActions" label="Other" size="normal">
+```
+
+The three elements occupy lines 448-465, six lines each. The `<button` open tag is indented ten spaces; its attributes are indented twelve. P2-T1 replaces lines 448-465 with three single lines indented ten spaces, which is a net reduction of fifteen lines (539 to 524).
+
+## Mutation target for the F1 fail-proof
+
+`TaskMaster\Ribbon\RibbonExplorer.xml` lines 99-105, the `<button id="TrainSpam" ...>` element:
+
+```xml
+ 99	          <button
+100	            id="TrainSpam"
+101	            imageMso="CancelAll"
+102	            onAction="TrainSpam_Click"
+103	            getEnabled="EngineCommand_GetEnabled"
+104	            label="Train Spam"
+105	          />
+```
+
+Line 103 is the whole-line deletion target for P1-T5. It is already in multi-line form, so the deletion requires no re-indentation and `git diff --numstat` will report exactly `0` added and `1` deleted. It sits in a different `group` from the three F2 elements, so the fail-proof mutation and the F2 edit do not overlap.
+
+Binary outcome satisfied: both blocks are present above, and the F1 block visibly contains the `?.Value.Should()` sequence at lines 199-200 that F1 removes.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md
new file mode 100644
index 000000000..deb753ae4
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-projection.2026-08-08T14-52.md
@@ -0,0 +1,151 @@
+# Phase 0 — Coverage Projection to First-Party JaCoCo Summary (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T12]
+Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-baseline.cobertura.xml -Destination docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\remediation-baseline\coverage-remediation-baseline.jacoco.xml`
+EXIT_CODE: 0
+
+## Why a projection rather than the raw report
+
+`coverage\remediation-baseline.cobertura.xml` is 187,490 lines and 10 MB. Following the convention established in `evidence/qa-gates/coverage-artifact-substitution.2026-08-08T17-40.md`, the raw report stays in the gitignored `coverage\` directory and only the package-level JaCoCo projection is committed. The script is a session-throwaway file held outside the working tree; its verbatim text is recorded below so the projection remains auditable and reproducible without adding a tracked script file to the repository.
+
+## Counting-method correction recorded
+
+The first execution of this script counted only the `<line>` children of each class's `<lines>` element. That yielded `LINE_COVERED=53368 / LINE_MISSED=9215` — roughly half the denominator of the committed implementation-cycle summary `evidence/qa-gates/coverage-final.jacoco.xml`, whose nine packages sum to 95473 covered and 15734 missed.
+
+Cobertura repeats each source line **twice**: once under the class-level `<lines>` element and once under the enclosing `<method>`'s own `<lines>`. The committed implementation-cycle summary was produced with **all-descendant** `<line>` counting. Using class-level-only counting here would have produced a denominator incommensurable with the figure P3-T9 must compare against, manufacturing a false ~44-point delta out of a measurement-method difference.
+
+The script was corrected to `$pkg.Descendants('line')` before the recorded run. The correction is verified by two independent identities against the committed implementation-cycle summary:
+
+- Derived `LINE_PCT = 85.8462` equals the root `<coverage line-rate="0.858462">` attribute of the source Cobertura report exactly.
+- The `TaskMaster` package resolves to `missed=1464 covered=3515`, byte-identical to the `TaskMaster` counter in `evidence/qa-gates/coverage-final.jacoco.xml`.
+
+## Verbatim script text
+
+```powershell
+param(
+    [Parameter(Mandatory = $true)][string]$Source,
+    [Parameter(Mandatory = $true)][string]$Destination
+)
+$ErrorActionPreference = 'Stop'
+
+# The nine first-party solution packages. Every other package in the Cobertura
+# report (vendored log4net, Microsoft.IO.RecyclableMemoryStream, Mono.Reflection,
+# System.Interactive, System.Linq.Async, and any *.Test package) is excluded.
+$included = @(
+    'QuickFiler', 'SVGControl', 'Tags', 'TaskMaster', 'TaskTree',
+    'TaskVisualization', 'ToDoModel', 'UtilitiesCS', 'VBFunctions'
+)
+
+$reader = [System.Xml.XmlReader]::Create((Resolve-Path $Source).Path)
+$doc = [System.Xml.Linq.XDocument]::Load($reader)
+$reader.Dispose()
+
+$rows = New-Object System.Collections.Generic.List[object]
+
+foreach ($pkg in $doc.Root.Element('packages').Elements('package')) {
+    $name = $pkg.Attribute('name').Value
+    if ($included -notcontains $name) { continue }
+
+    $lineCovered = 0
+    $lineMissed = 0
+    $branchCovered = 0
+    $branchMissed = 0
+
+    # All-descendant <line> counting. Cobertura repeats each line both under the
+    # class-level <lines> element and under each <method>/<lines>. The committed
+    # implementation-cycle summary (evidence/qa-gates/coverage-final.jacoco.xml) was
+    # produced with all-descendant counting; reproducing that method is what makes the
+    # P3-T9 delta commensurable. Class-level-only counting yields a ~2x smaller
+    # denominator and would manufacture a false delta.
+    foreach ($line in $pkg.Descendants('line')) {
+        if ($line.Attribute('hits').Value -ne '0') { $lineCovered++ } else { $lineMissed++ }
+        $cond = $line.Attribute('condition-coverage')
+        if ($null -ne $cond) {
+            $m = [regex]::Match($cond.Value, '\((\d+)/(\d+)\)')
+            if ($m.Success) {
+                $c = [int]$m.Groups[1].Value
+                $t = [int]$m.Groups[2].Value
+                $branchCovered += $c
+                $branchMissed += ($t - $c)
+            }
+        }
+    }
+
+    $rows.Add([pscustomobject]@{
+            Name          = $name
+            LineCovered   = $lineCovered
+            LineMissed    = $lineMissed
+            BranchCovered = $branchCovered
+            BranchMissed  = $branchMissed
+        })
+}
+
+$sb = New-Object System.Text.StringBuilder
+[void]$sb.AppendLine('<?xml version="1.0" encoding="UTF-8" standalone="yes"?>')
+[void]$sb.AppendLine('<report name="TaskMaster">')
+foreach ($r in $rows) {
+    [void]$sb.AppendLine(('  <package name="{0}">' -f $r.Name))
+    [void]$sb.AppendLine(('    <counter type="LINE" missed="{0}" covered="{1}" />' -f $r.LineMissed, $r.LineCovered))
+    [void]$sb.AppendLine(('    <counter type="BRANCH" missed="{0}" covered="{1}" />' -f $r.BranchMissed, $r.BranchCovered))
+    [void]$sb.AppendLine('  </package>')
+}
+[void]$sb.AppendLine('</report>')
+
+$destDir = Split-Path -Parent $Destination
+if ($destDir -and -not (Test-Path $destDir)) { New-Item -ItemType Directory -Path $destDir -Force | Out-Null }
+[System.IO.File]::WriteAllText($Destination, $sb.ToString())
+
+$tLineCovered = ($rows | Measure-Object -Property LineCovered -Sum).Sum
+$tLineMissed = ($rows | Measure-Object -Property LineMissed -Sum).Sum
+$tBranchCovered = ($rows | Measure-Object -Property BranchCovered -Sum).Sum
+$tBranchMissed = ($rows | Measure-Object -Property BranchMissed -Sum).Sum
+
+Write-Output ("PACKAGES={0}" -f $rows.Count)
+Write-Output ("LINE_COVERED={0}" -f $tLineCovered)
+Write-Output ("LINE_MISSED={0}" -f $tLineMissed)
+Write-Output ("BRANCH_COVERED={0}" -f $tBranchCovered)
+Write-Output ("BRANCH_MISSED={0}" -f $tBranchMissed)
+Write-Output ("LINE_PCT={0}" -f ([math]::Round(100.0 * $tLineCovered / ($tLineCovered + $tLineMissed), 4)))
+Write-Output ("BRANCH_PCT={0}" -f ([math]::Round(100.0 * $tBranchCovered / ($tBranchCovered + $tBranchMissed), 4)))
+foreach ($r in $rows) {
+    Write-Output ("PKG {0} LINE {1}/{2} BRANCH {3}/{4}" -f $r.Name, $r.LineCovered, ($r.LineCovered + $r.LineMissed), $r.BranchCovered, ($r.BranchCovered + $r.BranchMissed))
+}
+```
+
+## Output Summary
+
+```text
+PACKAGES=9
+LINE_COVERED=95467
+LINE_MISSED=15740
+BRANCH_COVERED=22133
+BRANCH_MISSED=5793
+LINE_PCT=85.8462
+BRANCH_PCT=79.2559
+PKG QuickFiler LINE 14345/17435 BRANCH 3044/4038
+PKG UtilitiesCS LINE 69205/76742 BRANCH 16107/19236
+PKG TaskVisualization LINE 2736/3012 BRANCH 649/768
+PKG SVGControl LINE 1696/3532 BRANCH 594/1248
+PKG ToDoModel LINE 2032/3442 BRANCH 468/928
+PKG Tags LINE 1374/1480 BRANCH 342/374
+PKG TaskMaster LINE 3515/4979 BRANCH 749/1138
+PKG TaskTree LINE 556/577 BRANCH 180/196
+PKG VBFunctions LINE 8/8 BRANCH 0/0
+```
+
+### Aggregate first-party totals (remediation baseline)
+
+| Counter | Covered | Missed | Total | Percentage |
+|---|---|---|---|---|
+| LINE | **95467** | **15740** | 111207 | **85.8462%** |
+| BRANCH | **22133** | **5793** | 27926 | **79.2559%** |
+
+`TaskMaster` package LINE counter at this baseline: `missed=1464 covered=3515` — identical to the implementation-cycle final figure, as expected for a cycle that has not yet changed anything.
+
+## Artifact checks
+
+- `evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml` exists, is **39 lines** (under the 100-line cap), and contains exactly **9** `<package>` elements.
+- No raw `.cobertura.xml` file is written anywhere under `<FEATURE>\evidence\`.
+
+Binary outcome satisfied on all four conditions.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml
new file mode 100644
index 000000000..436484051
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/coverage-remediation-baseline.jacoco.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<report name="TaskMaster">
+  <package name="QuickFiler">
+    <counter type="LINE" missed="3090" covered="14345" />
+    <counter type="BRANCH" missed="994" covered="3044" />
+  </package>
+  <package name="UtilitiesCS">
+    <counter type="LINE" missed="7537" covered="69205" />
+    <counter type="BRANCH" missed="3129" covered="16107" />
+  </package>
+  <package name="TaskVisualization">
+    <counter type="LINE" missed="276" covered="2736" />
+    <counter type="BRANCH" missed="119" covered="649" />
+  </package>
+  <package name="SVGControl">
+    <counter type="LINE" missed="1836" covered="1696" />
+    <counter type="BRANCH" missed="654" covered="594" />
+  </package>
+  <package name="ToDoModel">
+    <counter type="LINE" missed="1410" covered="2032" />
+    <counter type="BRANCH" missed="460" covered="468" />
+  </package>
+  <package name="Tags">
+    <counter type="LINE" missed="106" covered="1374" />
+    <counter type="BRANCH" missed="32" covered="342" />
+  </package>
+  <package name="TaskMaster">
+    <counter type="LINE" missed="1464" covered="3515" />
+    <counter type="BRANCH" missed="389" covered="749" />
+  </package>
+  <package name="TaskTree">
+    <counter type="LINE" missed="21" covered="556" />
+    <counter type="BRANCH" missed="16" covered="180" />
+  </package>
+  <package name="VBFunctions">
+    <counter type="LINE" missed="0" covered="8" />
+    <counter type="BRANCH" missed="0" covered="0" />
+  </package>
+</report>
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/csharpier-check.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/csharpier-check.2026-08-08T14-52.md
new file mode 100644
index 000000000..cb2f4f50b
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/csharpier-check.2026-08-08T14-52.md
@@ -0,0 +1,22 @@
+# Phase 0 — Repo-Wide CSharpier Check Baseline (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T8]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check ."`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+Checked 1498 files in 4001ms.
+```
+
+- Exit code: **0**.
+- Unformatted set: **empty**. CSharpier reported no file as needing formatting, so no verbatim file list is required.
+- Files checked: 1498, matching the figure recorded by the implementation cycle in `spec.md` Deviation 2.
+
+This measurement is read-only. `csharpier format` was **not** run in this task, per the task text. `csharpier pipe-files` was not used; it writes to stdout only and never mutates, so it is prohibited as a gate.
+
+## Comparison basis for P3-T2
+
+The P0-T8 baseline unformatted set is the **empty set**. P3-T2 therefore passes only on `EXIT_CODE: 0`; any non-zero exit at P3-T2 would report a set that is by definition not equal to this empty baseline and would restart the phase at P3-T1.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/embedded-ribbon-helper.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/embedded-ribbon-helper.2026-08-08T14-52.md
new file mode 100644
index 000000000..7f548d9cd
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/embedded-ribbon-helper.2026-08-08T14-52.md
@@ -0,0 +1,42 @@
+# Phase 0 — Embedded Ribbon Resource Helper and Pre-Remediation State (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T3]
+Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`
+EXIT_CODE: 0
+
+## Why this helper exists
+
+`TaskMaster\Ribbon\RibbonExplorer.xml` is an **embedded resource**. `RibbonExplorerXmlTests` reads it through `assembly.GetManifestResourceStream("TaskMaster.Ribbon.RibbonExplorer.xml")` on the `TaskMaster.dll` copied into `TaskMaster.Test\bin\Debug\`. An edit to the `.xml` on disk is invisible to the test until the assembly is rebuilt and re-copied. This helper asserts the byte content actually embedded in the built assembly, so the Phase 1 fail-proof cannot be a false negative caused by a stale assembly. It loads the assembly from a byte array rather than by path so it never holds a file lock that would block the next rebuild.
+
+## Verbatim script text
+
+The script is a session-throwaway file held outside the working tree. Its verbatim text is recorded here so the assertion is auditable and reproducible without the scratchpad.
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$RepoRoot)
+$ErrorActionPreference = 'Stop'
+$dll = Join-Path $RepoRoot 'TaskMaster.Test\bin\Debug\TaskMaster.dll'
+$asm = [System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($dll))
+$stream = $asm.GetManifestResourceStream('TaskMaster.Ribbon.RibbonExplorer.xml')
+$text = (New-Object System.IO.StreamReader($stream)).ReadToEnd()
+$count = ([regex]::Matches($text, 'getEnabled="EngineCommand_GetEnabled"')).Count
+$single = '<button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />'
+Write-Output ("EMBEDDED_GETENABLED_COUNT={0}" -f $count)
+Write-Output ("EMBEDDED_TRIAGESETA_SINGLELINE={0}" -f $text.Contains($single))
+Write-Output ("EMBEDDED_ASSEMBLY_WRITETIME={0}" -f (Get-Item $dll).LastWriteTimeUtc.ToString('o'))
+```
+
+## Output Summary
+
+```text
+EMBEDDED_GETENABLED_COUNT=8
+EMBEDDED_TRIAGESETA_SINGLELINE=False
+EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T17:48:38.5907327Z
+```
+
+- `EMBEDDED_GETENABLED_COUNT=8` — the pre-remediation assembly carries all eight `getEnabled="EngineCommand_GetEnabled"` attributes, matching the state delivered by the implementation cycle.
+- `EMBEDDED_TRIAGESETA_SINGLELINE=False` — expected at this point. The `TriageSetA` button is currently in the six-line form that F2 collapses. This flag becomes `True` after P2-T1 and is the P2-T4 gate.
+- `EMBEDDED_ASSEMBLY_WRITETIME=2026-08-08T17:48:38.5907327Z` — the write time of the currently built `TaskMaster.dll`, recorded so a later rebuild can be distinguished from a stale artifact. (The recorded value is the file-system timestamp as reported; no interpretation of clock skew is made here.)
+
+Binary outcome satisfied: `EMBEDDED_GETENABLED_COUNT=8` and `EMBEDDED_TRIAGESETA_SINGLELINE=False`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/file-line-counts.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/file-line-counts.2026-08-08T14-52.md
new file mode 100644
index 000000000..f919e4cef
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/file-line-counts.2026-08-08T14-52.md
@@ -0,0 +1,43 @@
+# Phase 0 — Pre-Remediation File Line Counts (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T6]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; 'TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs','TaskMaster\Ribbon\RibbonExplorer.xml' | ForEach-Object { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines }; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=' -AllMatches | Measure-Object).Count"`
+EXIT_CODE: 0
+
+Corroborating command: `wc -l "TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs" "TaskMaster/Ribbon/RibbonExplorer.xml"` plus `grep -c '^[[:space:]]*$'` on each path.
+
+## Output Summary
+
+Verbatim output of the plan's stated command:
+
+```text
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs=279
+TaskMaster\Ribbon\RibbonExplorer.xml=539
+8
+```
+
+Corroborating physical line counts:
+
+```text
+  309 TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs
+  539 TaskMaster/Ribbon/RibbonExplorer.xml
+```
+
+Blank-line counts: `RibbonExplorerXmlTests.cs` = 30; `RibbonExplorer.xml` = 0.
+
+| Path | Plan expectation | `Measure-Object -Line` | Physical (`wc -l`) | Reconciled |
+|---|---|---|---|---|
+| `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | 309 | 279 | **309** | Yes — matches the plan expectation on the physical count |
+| `TaskMaster\Ribbon\RibbonExplorer.xml` | 539 | 539 | **539** | Yes — both methods agree |
+| `getEnabled=` occurrences in `RibbonExplorer.xml` | 8 | 8 | — | Yes |
+
+## Recorded measurement-method deviation (not a tree deviation)
+
+The plan's stated measurement, `(Get-Content $path | Measure-Object -Line).Lines`, reports **279** for `RibbonExplorerXmlTests.cs` against the plan's stated expectation of **309**. This is a **measurement-method artifact, not a difference in the file**: `Measure-Object -Line` counts lines within each input string and contributes zero for an empty string, so the 30 blank lines in that file are not counted. `wc -l` reports the physical count of 309, which is the figure the plan expected and the figure the 500-line cap is expressed against.
+
+`RibbonExplorer.xml` contains zero blank lines, so the two methods agree at 539 for that path and every later gate on the XML (the 527 ceiling in P2-T2 and P3-T3) is unaffected by the discrepancy regardless of which method is used.
+
+Consequence recorded for later tasks: where a `.cs` path is measured against the 500-line cap (P1-T1 and P3-T3), the physical count is the binding figure. `Measure-Object -Line` under-reports it and must not be used alone to certify a `.cs` file as under the cap. This observation is recorded, not acted on beyond the two files in this cycle's scope lock; it is not a defect in the source tree and no file is modified in response to it.
+
+Binary outcome satisfied on the reconciled physical counts: `RibbonExplorerXmlTests.cs` = 309, `RibbonExplorer.xml` = 539, and 8 `getEnabled` occurrences. The `Measure-Object -Line` figure of 279 is recorded verbatim above rather than overwritten.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/git-state.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/git-state.2026-08-08T14-52.md
new file mode 100644
index 000000000..62dacd1ae
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/git-state.2026-08-08T14-52.md
@@ -0,0 +1,41 @@
+# Phase 0 — Git State Audit Record (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T5]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git rev-parse HEAD; git rev-parse --abbrev-ref HEAD; git status --porcelain"`
+EXIT_CODE: 0
+
+## Output Summary
+
+- HEAD at cycle start: `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c`
+- Branch: `bug/ribbon-engine-readiness-guard-503`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2`
+
+The recorded HEAD is an **audit record only**. Per plan section 3 rule 10, no later gate in this cycle is expressed as equality against this SHA; all later gates are tree invariants.
+
+### `git status --porcelain`, verbatim
+
+```text
+ M .claude/agent-memory/atomic-executor/MEMORY.md
+ M .claude/agent-memory/atomic-executor/project_preflight_mergebase_diff_gates_need_commit_cadence.md
+ M .claude/agent-memory/atomic-planner/MEMORY.md
+ M .claude/agent-memory/feature-review/MEMORY.md
+ M .claude/agent-memory/feature-review/project_pr-context-summary-misclassifies-cs.md
+?? .claude/agent-memory/atomic-planner/embedded-resource-failproof-rebuild-gate.md
+?? .claude/agent-memory/feature-review/project_nullable_build_gate_is_vacuous.md
+?? .claude/agent-memory/feature-review/project_package-counter-delta-corroborates-new-type-coverage.md
+?? .claude/agent-memory/feature-review/project_two-vstest-binaries-binding-redirect.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/code-review.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md
+?? docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md
+?? docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md
+```
+
+### Classification of the pre-existing uncommitted set
+
+All sixteen entries are Markdown documentation, agent-memory, or evidence-directory paths carried in from the review cycle, plus the two artifacts of this cycle itself (`remediation-inputs.2026-08-08T14-26.md`, `remediation-plan.2026-08-08T14-26.md`) and the newly created `evidence/remediation-baseline/` directory. This set is the P3-T11 bucket (c) reference list: an entry appearing in a later porcelain that also appears here was neither created nor modified by this cycle's source work.
+
+Binary outcome satisfied: **no `.cs`, `.csproj`, `.xml`, or `.sln` path appears in the porcelain output.** The working tree carries no uncommitted source change at cycle start.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-analyzers.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-analyzers.2026-08-08T14-52.md
new file mode 100644
index 000000000..5f0bce026
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-analyzers.2026-08-08T14-52.md
@@ -0,0 +1,31 @@
+# Phase 0 — Analyzer Build Baseline (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T9]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+    6 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:19.32
+```
+
+- **Errors: 0.**
+- **Warnings: 6.**
+
+### Baseline warning set (the comparison basis for P3-T4)
+
+| Count | Diagnostic | Projects |
+|---|---|---|
+| 5 | `System.Reactive.PackagesConfigCheck.targets(31,5): warning : The project contains a packages.config file, which is not supported by System.Reactive v7.0 or later.` | emitted once per project that references `System.Reactive 7.0.0`, including `QuickFiler.csproj`, `TaskMaster.csproj`, and `UtilitiesCS.Test.csproj` |
+| 1 | `CSC : warning CS2002: Source file '...\UtilitiesCS.Test\OutlookObjects\Folder\PercentageFormatterTests.cs' specified multiple times` | `UtilitiesCS.Test.csproj` |
+
+Both diagnostics are pre-existing and untouched by this cycle. `CS2002` is the duplicate `<Compile Include>` entry routed to issue **#510** and is explicitly out of scope; it must not be fixed here. The `System.Reactive` packages.config advisory is a build-infrastructure notice unrelated to this change.
+
+P3-T4 passes on `EXIT_CODE: 0` with no diagnostic absent from this set.
+
+Binary outcome satisfied: `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-nullable.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-nullable.2026-08-08T14-52.md
new file mode 100644
index 000000000..0fc95ba79
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/msbuild-nullable.2026-08-08T14-52.md
@@ -0,0 +1,30 @@
+# Phase 0 — Nullable / Type-Check Build Baseline (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T10]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true"`
+EXIT_CODE: 0
+
+## Output Summary
+
+```text
+    5 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:01.55
+```
+
+- **Errors: 0.** The policy-mandated type-check gate passes.
+- **Warnings: 5**, all instances of the pre-existing `System.Reactive` packages.config advisory recorded in the P0-T9 baseline. The `CS2002` warning does not reappear here because `CoreCompile` did not run (see below).
+
+## Known limitation of this gate (recorded, out of scope)
+
+`code-review.2026-08-08T14-15.md` records, and this run corroborates, that **exit 0 from this command alone does not prove the tree is nullable-clean**. MSBuild's up-to-date check skips the `CoreCompile` target when only `/p:` property values change relative to the previous build, so the compiler is never re-invoked with `Nullable=enable` in force. The elapsed time of **1.55 seconds** for a full-solution build — against 19.32 seconds for the P0-T9 analyzer build that did compile — is direct evidence that no compilation occurred in this invocation.
+
+The review independently established the substance behind the gate: a forced `/t:Rebuild` of `TaskMaster.csproj` surfaces 195 errors, 64 of them `CS86xx`, all in files untouched by this feature branch (`OutlookItemTry.cs` 35, `OutlookItemFlaggableTry.cs` 30, `ItemInfo.cs` 20, `PropertyStore.cs` 17), with **zero** attributable to any of the six new production files.
+
+This gate defect and the underlying repository-wide nullable debt are tracked as issue **#512** and are **explicitly out of scope for this remediation cycle**. They are recorded here, not remediated. This cycle changes one C# test file and one XML resource; it introduces no new nullable surface.
+
+P3-T5 runs the identical command and restates this limitation.
+
+Binary outcome satisfied: `EXIT_CODE: 0`.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-inputs-read.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-inputs-read.2026-08-08T14-52.md
new file mode 100644
index 000000000..5c1e6d695
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-inputs-read.2026-08-08T14-52.md
@@ -0,0 +1,48 @@
+# Phase 0 — Remediation Inputs and Supporting Context Read (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T2]
+Command: Read tool invocations against each absolute path listed below (read-only inspection; no command executed)
+EXIT_CODE: 0
+
+## Files read (six absolute paths)
+
+1. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\remediation-inputs.2026-08-08T14-26.md`
+2. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md`
+3. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\plan.2026-08-08T11-59.md`
+4. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\code-review.2026-08-08T14-15.md`
+5. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\policy-audit.2026-08-08T14-15.md`
+6. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\feature-audit.2026-08-08T14-15.md`
+
+## Resolved work mode and acceptance-criteria source
+
+- Work mode: **`full-bug`**, read from the persisted marker `- Work Mode: full-bug` in `spec.md` (line 9) and corroborated by `issue.md:12` as recorded in `feature-audit.2026-08-08T14-15.md`.
+- Per `.claude/skills/acceptance-criteria-tracking/SKILL.md`, `full-bug` resolves the authoritative acceptance-criteria source to **`spec.md` only**. No `user-story.md` exists for this issue and none is to be created.
+- `spec.md` holds 30 acceptance criteria (AC1-AC30). 27 are `- [x]`; AC19, AC20, and AC21 are `- [ ]` and are MANUAL-ONLY.
+
+## In-scope findings for this cycle — exactly two
+
+**F1 — Vacuous assertion in the AC5 ribbon-XML test (Medium, in-scope).**
+Location: `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, approximately lines 197-206, inside `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback`. The assertion is written `...Attribute("getEnabled")?.Value.Should().Be("EngineCommand_GetEnabled")`. The null-conditional `?.` short-circuits the whole expression including the `.Should()` call, so when the attribute is absent — the exact regression the test exists to catch — no assertion executes and the test passes silently. Required outcome: the assertion must fail when the attribute is missing, when it is present with the wrong value, and when it is present but empty. Acceptance requires a deliberate temporary removal of one `getEnabled` attribute from the embedded ribbon resource, confirmation that this specific test fails, then restoration, with the fail-then-restore proof recorded as regression-testing evidence. The permanent test suite must not contain the temporary mutation.
+
+**F2 — `RibbonExplorer.xml` grew more than the change required (Medium, in-scope).**
+The file went from 519 to 539 lines while already above the 500-line cap, which `spec.md` AC25 records as an accepted pre-existing exception rather than something this change may worsen. Only 8 of the added lines are functionally required (one `getEnabled` attribute per engine-backed button); approximately 12 came from reformatting three previously single-line `<button>` elements (`TriageSetA`, `TriageSetB`, `TriageSetC`) into multi-line form. Required outcome: restore those three elements to single-line form while retaining their `getEnabled` attribute. Acceptance: line count at or below 527, all eight `getEnabled` attributes present and correct, AC5/AC6/AC7 ribbon-XML tests still passing, and the embedded resource still parsing as valid CustomUI.
+
+No third finding is in scope. The `feature-review` pass returned PASS with zero Blocking findings, so this cycle is discretionary; its exit gate is the same reaudit standard.
+
+## Out-of-scope list, verbatim from remediation-plan section 6
+
+Do not touch, fix, re-promote, or re-litigate any of the following. Each is already routed to its own issue or was assessed and dismissed by the review.
+
+- Issue **#512** — pre-existing repository-wide nullable debt and the vacuous type-check gate.
+- Issue **#510** — the `CS2002` duplicate `<Compile Include>` entry in `UtilitiesCS.Test.csproj`.
+- Issue **#508** — the `YieldAsync_WithoutDispatcher_RemainsStrict` order-dependent flake.
+- The residual `engine as SpamBayes` / `.Engine` dereference window (Low; the click guard makes the reported defect unreachable, and narrowing the readiness contract is a design change, not a fix).
+- The `??=` lazy-initialiser thread-safety observation in `RibbonController.EngineCommands.cs` (Low; the runner is immutable and the reviewer assessed it benign).
+- Any change to `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` — AC15 requires a zero-line diff on both.
+- AC19, AC20, AC21 — MANUAL-ONLY, must remain unchecked.
+- Issues **#504**, **#505**, **#506**, **#507**, **#509**, **#511** — already promoted out-of-scope findings.
+
+## Output Summary
+
+Six supporting documents read. Work mode resolved to `full-bug` with `spec.md` as the sole acceptance-criteria source. Exactly two in-scope findings for this cycle: F1 (vacuous AC5 ribbon-XML assertion) and F2 (`RibbonExplorer.xml` line growth). Eight out-of-scope categories recorded verbatim and must not be touched. Blocking findings entering the cycle: 0. `plan.2026-08-08T11-59.md` sections 4 (scope lock) and 5 (contract specifications) remain authoritative and are not re-litigated here.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-instructions-read.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-instructions-read.2026-08-08T14-52.md
new file mode 100644
index 000000000..8f7c59583
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/phase0-instructions-read.2026-08-08T14-52.md
@@ -0,0 +1,32 @@
+# Phase 0 — Policy Instructions Read (Remediation Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T1]
+Command: Read tool invocations against each absolute path listed below (read-only inspection; no command executed)
+EXIT_CODE: 0
+
+Policy Order: The order defined by `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\skills\policy-compliance-order\SKILL.md` — standing instructions first (`CLAUDE.md`), then the cross-language code-change policy, then the cross-language unit-test policy, then the language- and domain-specific rules for the files in scope (C#), followed by the architecture-boundary, quality-tier, and tonality rules.
+
+## Files read, in order
+
+1. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\CLAUDE.md` (441 lines)
+2. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\general-code-change.md` (80 lines)
+3. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\general-unit-test.md` (105 lines)
+4. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\csharp.md` (96 lines)
+5. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\architecture-boundaries.md` (46 lines)
+6. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\quality-tiers.md` (51 lines)
+7. `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\.claude\rules\tonality.md` (80 lines)
+
+All seven paths were confirmed present on disk with the line counts shown.
+
+## Output Summary
+
+Seven policy files read in the required order. Constraints that bind this remediation cycle:
+
+- **CLAUDE.md / `.claude/rules/csharp.md`** — C# toolchain order is format (CSharpier) -> lint (MSBuild analyzers) -> type-check (MSBuild nullable) -> test (vstest with coverage). Restart from step 1 on any failure or file change. `dotnet format` is prohibited. MSTest + Moq + FluentAssertions are the mandated test stack.
+- **`.claude/rules/csharp.md` Prohibited Behaviors** — weakening assertions to make tests pass is prohibited. This cycle strengthens the AC5 assertion (F1); it does not weaken any assertion.
+- **`.claude/rules/general-code-change.md`** — 500-line file cap for production, test, and reusable script files; Markdown documentation is exempt. `RibbonExplorer.xml` is over the cap at the merge-base (accepted as AC25); F2 reduces it toward that accepted figure.
+- **`.claude/rules/general-unit-test.md`** — line coverage >= 85 percent, branch coverage >= 75 percent; no regression on changed lines; temporary files in tests are prohibited. This cycle writes no temporary file inside a test.
+- **`.claude/rules/architecture-boundaries.md`** — no new runtime code is added by this cycle; the ribbon callback surface is pre-existing legacy VSTO code that this cycle does not extend.
+- **`.claude/rules/quality-tiers.md`** — uniform coverage thresholds across T1-T4.
+- **`.claude/rules/tonality.md`** — professional, factual, measured tone in all artifacts produced by this cycle.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/preexisting-failures.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/preexisting-failures.2026-08-08T14-52.md
new file mode 100644
index 000000000..f6d3de81c
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/preexisting-failures.2026-08-08T14-52.md
@@ -0,0 +1,31 @@
+# Phase 0 — Pre-Existing Failing Test Set and Phase 3 Pass Rule (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T13]
+Source measurement: `evidence/remediation-baseline/tests-with-coverage.2026-08-08T14-52.md` (P0-T11)
+
+## The recorded pre-existing failing set
+
+The P0-T11 full-suite run reported 6338 total, 6338 passed, 0 failed, 0 skipped.
+
+**The recorded set is EMPTY.** No test failed in the baseline run.
+
+This is the explicit empty case the task text requires be enumerated rather than omitted.
+
+## The #508 flake
+
+`UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` is a **pre-existing order-dependent flake** tracked by issue **#508**. It is **explicitly out of scope for this remediation cycle** and **must not be fixed here**.
+
+It **passed** in the P0-T11 baseline run, which is consistent with its recorded character: the failure is order-dependent, not deterministic, so a single green baseline run neither proves it fixed nor removes it from the known-flake set. Because the plan's section 3 rule 9 names it explicitly as a member of the tolerated set, it is admitted to the pass rule below even though it did not fail in this particular baseline. Admitting it is the conservative reading: it prevents a known, already-routed flake from being misclassified as a regression introduced by this cycle.
+
+## Pass rule for Phase 3, stated verbatim
+
+A Phase 3 test run passes when the only failures are members of this recorded set; any test not in this set that fails is a real regression that restarts Phase 3 at P3-T1; issue #508 must not be fixed in this cycle.
+
+## The set, enumerated explicitly
+
+| # | Fully-qualified test name | Basis for admission |
+|---|---|---|
+| 1 | `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` | Named explicitly by plan section 3 rule 9 as a pre-existing order-dependent flake tracked by issue **#508**, out of scope. Did **not** fail in the P0-T11 baseline. |
+
+No other test is a member. The P0-T11 observed failure set was empty, so a Phase 3 run with **zero** failures is the expected outcome, and a Phase 3 run whose only failure is entry 1 above is also a pass. Any other failure restarts Phase 3 at P3-T1.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/tests-with-coverage.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/tests-with-coverage.2026-08-08T14-52.md
new file mode 100644
index 000000000..b6be17b74
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/tests-with-coverage.2026-08-08T14-52.md
@@ -0,0 +1,51 @@
+# Phase 0 — Full-Suite Test and Coverage Baseline (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T11]
+Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput coverage\remediation-baseline.cobertura.xml` run from `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55`
+EXIT_CODE: 0
+
+## Output Summary
+
+### Test counts
+
+```text
+Test Run Successful.
+Total tests: 6338
+     Passed: 6338
+ Total time: 40.7684 Seconds
+```
+
+| Metric | Value |
+|---|---|
+| Total | 6338 |
+| Passed | 6338 |
+| Failed | **0** |
+| Skipped | **0** |
+
+### Failure set
+
+**Empty.** No test failed in this baseline run. In particular `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` — the pre-existing order-dependent flake tracked as issue **#508** — **passed** in this run. That is consistent with its recorded character: it is order-dependent, not deterministically failing. P0-T13 records the resulting pass rule.
+
+### Coverage headline (root `<coverage>` attributes, verbatim)
+
+```xml
+<coverage line-rate="0.858462" branch-rate="0.792559" complexity="24678" version="1.9"
+          timestamp="1786215545" lines-covered="95467" lines-valid="111207"
+          branches-covered="22133" branches-valid="27926">
+```
+
+| Attribute | Value |
+|---|---|
+| `line-rate` | **0.858462** (85.8462%) |
+| `branch-rate` | **0.792559** (79.2559%) |
+| `lines-covered` | **95467** |
+| `lines-valid` | **111207** |
+| `branches-covered` | 22133 |
+| `branches-valid` | 27926 |
+
+### Artifact location
+
+`coverage\remediation-baseline.cobertura.xml` — 187,490 lines, 10 MB. This path is gitignored (`.gitignore:144` ignores `coverage/*`) and is **never committed**. P0-T12 projects it into a compact package-level JaCoCo summary, and only that summary is written under `<FEATURE>\evidence\`.
+
+Binary outcome satisfied: zero skipped tests, and the failure set is recorded above as empty.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/toolchain-and-restore.2026-08-08T14-52.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/toolchain-and-restore.2026-08-08T14-52.md
new file mode 100644
index 000000000..537c90484
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/remediation-baseline/toolchain-and-restore.2026-08-08T14-52.md
@@ -0,0 +1,26 @@
+# Phase 0 — Toolchain Availability and NuGet Restore (Cycle 1, Issue #503)
+
+Timestamp: 2026-08-08T14-52
+Task: [P0-T4]
+Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Test-Path 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe'; Test-Path 'TaskMaster.runsettings'; nuget restore TaskMaster.sln"`
+EXIT_CODE: 0
+
+## Output Summary
+
+| Probed path | Result |
+|---|---|
+| `C:\Users\DanMoisan\.dotnet\tools\csharpier.exe` | `True` |
+| `C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe` | `True` |
+| `C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` | `True` |
+| `TaskMaster.runsettings` (repo-relative) | `True` |
+
+NuGet restore result:
+
+```text
+MSBuild auto-detection: using msbuild version '18.8.2.30814' from 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin'.
+All packages listed in packages.config are already installed.
+```
+
+The restore also performed its routine vulnerability-index fetch against `api.nuget.org` and returned `OK` for each request. No package was installed or upgraded; the restore is idempotent and the tree was already restored, which is the expected result stated by plan section 3 rule 3.
+
+Binary outcome satisfied: all four `Test-Path` probes report `True` and the restore exits 0.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md
new file mode 100644
index 000000000..a73caac63
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T14-15.md
@@ -0,0 +1,92 @@
+# Feature Audit — ribbon-engine-readiness-guard (Issue #503)
+
+- Feature folder: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`
+- Reviewed: 2026-08-08T14-15
+
+## Scope and Baseline
+
+- Base branch: `main`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2`, recomputed this session with `git merge-base HEAD origin/main` and confirmed to match the caller-supplied value
+- Head: `bug/ribbon-engine-readiness-guard-503` @ `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c`
+- Audit basis: the complete three-dot diff `003c5715055d7d1933db68a742531332756e30b2...HEAD`, 86 changed paths (16 C#, project, and embedded-resource paths; 70 Markdown, XML-evidence, and agent-memory paths)
+- Work mode: `full-bug`, read from the persisted marker `- Work Mode: full-bug` at `issue.md:12`
+- Authoritative acceptance-criteria source: `spec.md` **only**. Per `.claude/skills/acceptance-criteria-tracking/SKILL.md`, `full-bug` resolves to `spec.md` alone. No `user-story.md` exists for this issue and none is required.
+- Commits in range: 6 (`0f10bf30` planning and Phase 0 baseline; `f09e3cf8` the fix; `aa0417d2` Phase 5-7 verification plus three nullable corrections to authored code; `4086f613`, `392102b9`, `d0955dc4` documentation and evidence only)
+- Source-tree stability: the MD5 fingerprints of all nine touched source paths recorded in `evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md` are identical to the files on disk at head, so the recorded clean toolchain pass applies to the tree under review.
+
+## Acceptance Criteria Inventory
+
+- Source file: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md`, section `## Acceptance Criteria`
+- Total acceptance criteria: **30** (AC1 through AC30)
+- Marked `[x]` in the source file at review time: **27** (AC1-AC18, AC22-AC30)
+- Marked `[ ]` in the source file at review time: **3** (AC19, AC20, AC21), each labelled **MANUAL-ONLY** with the explicit instruction that they must never be checked off on the strength of unit tests
+- Traceability: AC items map to requirements R1-R6 and issue acceptance bullets A1-A4, both tabulated in `spec.md` under `## Requirements (canonical numbering)`
+
+## Acceptance Criteria Evaluation
+
+| AC | Verdict | Evidence and verification performed this session |
+|---|---|---|
+| AC1 (R1) | PASS | `TaskMaster/Ribbon/EngineReadinessGate.cs` exists at 103 lines, declared `internal sealed class EngineReadinessGate` (line 30). `grep -nE "^\s*\[ExcludeFromCodeCoverage\]"` over the file returns no match. Its only using directives are `System` and `UtilitiesCS`; the only `Microsoft.Office` occurrence is prose inside an XML doc comment. The four-part predicate (non-null accessor result, non-null `InboxEngines`, key present, value non-null) is implemented at lines 82-100. |
+| AC2 (R1) | PASS | All six negative cases and the ordinal case-sensitivity case are covered by named tests in `EngineReadinessGateTests.cs` and all pass in the re-run this session. `TryGetEngine` guards `IsNullOrWhiteSpace` (line 82), null `InboxEngines` (line 89), and a null dictionary value (line 94). |
+| AC3 (R1) | PASS | `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` mutates one `ConcurrentDictionary` instance between two probes and asserts `false` then `true`. No sleep, delay, or wall-clock read appears. The gate caches nothing: `TryGetEngine` re-invokes the accessor on every call. |
+| AC4 (R1) | PASS | `EngineReadinessGate.cs:47-48` throws `ArgumentNullException(nameof(enginesAccessor))`; `Constructor_WithNullAccessor_ThrowsArgumentNullException` asserts it with `WithParameterName`. |
+| AC5 (R2) | PASS | All eight `getEnabled="EngineCommand_GetEnabled"` attributes are present in the XML diff on `TrainSpam`, `TrainHam`, `TestSpam`, `TriageSetA`, `TriageSetB`, `TriageSetC`, `FilterTriageGroup`, and `ClearTriage`. Verified directly from `git diff -- TaskMaster/Ribbon/RibbonExplorer.xml`. The named test passes, and the guarantee is genuinely enforced by the sibling set-equality test at AC6; note the code-review Medium finding that the AC5 test's own assertion is vacuous when the attribute is absent. |
+| AC6 (R2) | PASS | `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` asserts `BeEquivalentTo(EngineCommandCatalog.ControlIds)` over every element declaring the callback, which fails on both over- and under-declaration. Independently confirmed from the XML diff: exactly eight added `getEnabled` attributes, none on `menu id="OtherSpamActions"`, `menu id="OtherTriageActions"`, or any `group`/`tab`. |
+| AC7 (R2) | PASS | `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` asserts `Name.LocalName == "button"` for every catalog id. Independently confirmed from the diff: all eight attributes sit on `<button>` elements. |
+| AC8 (R2) | PASS | `RibbonViewer.EngineCommands.cs:38-39` declares `public bool EngineCommand_GetEnabled(Office.IRibbonControl control)`. `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` pins it by reflection on public-instance binding flags, `bool` return, single parameter, and the parameter type's full name `Microsoft.Office.Core.IRibbonControl`. Test passes. |
+| AC9 (R2) | PASS | `EngineCommandCatalog.Map` (lines 36-49) contains exactly eight entries built with `StringComparer.Ordinal`: three mapping to `"Spam"` and five to `"Triage"`. `TryGetEngineName` returns false for null and empty ids (line 76) and for unknown ids via `Map.TryGetValue`. `ControlIds` is projected from `Map.Keys`, so duplicates are impossible by construction. |
+| AC10 (R3, A1) | PASS | Source-verified across `RibbonViewer.EngineCommands.cs` lines 88-184: each of the eight handlers is `await Controller.RunEngineCommandAsync("<id>", () => <engine expression>)`, so the engine expression sits inside the lambda. `RunAsync` returns `Task.CompletedTask` without invoking the action when the gate is closed (`EngineGatedCommandRunner.cs:104-108`). |
+| AC11 (R3, A1) | PASS | `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` and `RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException` both assert `NotThrowAsync` and that the deferred body never ran. Both pass in the re-run this session. Together they cover both reported exception types. |
+| AC12 (R3) | PASS | `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName` asserts `ContainSingle` on the injected sink and that the message contains both `"TriageSetA"` and `"Triage"`. The test constructs no `Form`, `MessageBox`, or message pump; grep over `TaskMaster.Test/Ribbon/*.cs` for those symbols returns no match. |
+| AC13 (R3) | PASS | `RunAsync_WithNullAction_ThrowsArgumentNullException` (and asserts no notification was emitted, confirming the precondition is checked before the gate is queried) and `RunAsync_WithUnknownControlId_DoesNotInvokeAction`. Both pass. |
+| AC14 (R3) | PASS | `RunAsync_WhenActionThrows_PropagatesException` asserts the original `InvalidOperationException` and its message survive. Independently confirmed that no `catch` clause was added anywhere: `git diff ... -- '*.cs' \| grep "^+.*catch"` matches exactly one line, which is prose in an XML doc comment. `EngineGatedCommandRunner.cs` contains no `catch` token at all. |
+| AC15 (R4) | PASS | `git diff --name-status 003c5715...HEAD` lists neither `TaskMaster/AppGlobals/AppItemEngines.cs` nor `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`; `TaskMaster/AppGlobals/ApplicationGlobals.cs` is likewise absent. No `IsInitialized`/`InitTask` flag and no interface member was introduced. |
+| AC16 (R6, A2) | PASS | Side-by-side reading of the removed region of `RibbonViewer.cs` (lines 250-347 at merge-base) against the added region of `RibbonViewer.EngineCommands.cs` confirms every relocated expression is byte-identical apart from the `RunEngineCommandAsync` wrapping. On the ready path `RunAsync` returns `action()` directly, preserving await semantics. `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` and `RunAsync_WhenEngineReady_AwaitsActionToCompletion` both pass. |
+| AC17 (R5c, A4) | PASS | `EngineCommandRefreshPlanner.InvalidateAll` iterates `EngineCommandCatalog.ControlIds` exactly once each and throws `ArgumentNullException` for a null delegate. `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` asserts set equality plus an exact count; `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException` asserts the precondition. Both pass. |
+| AC18 (R5c, A4) | PASS | `RibbonViewer.EngineCommands.cs:63-81`: returns early when `_ribbon` is null; obtains `UiThread.Dispatcher` and, when `CheckAccess()` is false, marshals through `dispatcher.Invoke` rather than relying on the ambient synchronization context. `ThisAddIn.cs:77-81` invokes `_ribbonController.RefreshEngineCommands()` exactly once, immediately after `await _globals.LoadAsync(false)`, with a why-comment. Both members are inside `[ExcludeFromCodeCoverage]` types by design, so source inspection is the prescribed verification. |
+| AC19 (R5b, A3) | UNVERIFIED | MANUAL-ONLY. Requires a live Outlook process and mail profile, which `.claude/rules/general-unit-test.md` forbids automated tests from depending on. The maintainer checklist at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` carries `Status: PENDING MAINTAINER EXECUTION`. Correctly left `[ ]`; checking it off from unit-test evidence would violate the criterion's own text. |
+| AC20 (R5b, A2, A3) | UNVERIFIED | MANUAL-ONLY, same basis as AC19. The automated half of the ready-path guarantee is covered by AC16 (byte-identical expressions plus exactly-once invocation with awaited completion), but live behavioural equivalence in Outlook remains maintainer-verified. |
+| AC21 (R5c, A4) | UNVERIFIED | MANUAL-ONLY, same basis. Office's per-control callback caching is internal to the host and is not locally observable. This is also the only check that proves the `getEnabled` callback is actually bound, since VSTO silently ignores a signature mismatch; the AC8 reflection test pins the signature but cannot prove host binding. |
+| AC22 (R5a) | PASS | All four stages re-run this session: `csharpier check .` exit 0 over 1498 files; analyzer msbuild exit 0; nullable msbuild exit 0; the changed-assembly test run exit 0 with 69/69. The executor's recorded single uninterrupted pass (`evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md`) reports 6,338 passed, 0 failed, 0 skipped, with MD5 fingerprints at both ends of the pass matching the tree on disk today. Restart history is disclosed transparently: two restarts preceded the recorded clean pass. |
+| AC23 (R5a) | PASS | All four new types measured at 1.000000 line rate in `evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md` (48/48, 48/48, 72/72, 18/18). Independently corroborated this session by a route that does not depend on the removed per-class detail: the `TaskMaster` package `LINE` counter moved from `missed=1464 covered=3329` to `missed=1464 covered=3515` between the committed baseline and final JaCoCo summaries — an increase of exactly 186 covered lines with **zero** increase in missed, where 186 is the exact line total of the four new types. Any uncovered new line would necessarily have raised the missed count. Caveat recorded in the policy audit: the artifact named by this AC no longer carries per-type granularity after commit `d0955dc4`, so the substance is verified while re-derivation from the named artifact alone is no longer possible. |
+| AC24 (R5a) | PASS | Baseline captured at the merge-base before implementation (`evidence/baseline/coverage-baseline.jacoco.xml`, projected from the Phase 0 Cobertura run) and compared in `evidence/qa-gates/coverage-comparison.2026-08-08T14-56.md`. Re-derived this session: line 85.85% (95,309/111,021) to 85.85% (95,473/111,207), +0.0039 points; branch 79.24% (22,077/27,862) to 79.25% (22,131/27,926), +0.0117 points. Both moved up. No changed-line regression: the unchanged `missed=1464` figure for the `TaskMaster` package is the direct measurement, and the three modified production files sit inside types coverage-exempt at both ends, so nothing moved from measured to unmeasured. |
+| AC25 | PASS | Measured with `awk NR` at head: every changed `.cs` file is at or under 500 lines, with the largest at 388 (`RibbonViewer.cs`, down from 487 via the required partial-class split) and 346 (`EngineGatedCommandRunnerTests.cs`). `RibbonExplorer.xml` is the criterion's own explicit carve-out. Recorded observation, raised as a Medium code-review finding rather than an AC failure: the resource moved from 519 to 539 lines, and 12 of the 20 added lines come from reformatting three previously single-line buttons rather than from the fix itself. |
+| AC26 | PASS | `grep -nE "^\s*\[ExcludeFromCodeCoverage\]" TaskMaster/Ribbon/Engine*.cs` returns no match. The only textual occurrences in those four files are XML doc comments asserting the attribute's deliberate absence. |
+| AC27 | PASS | `git diff ... -- '*.cs' \| grep "^+.*ComVisible"` matches exactly one line, which is prose in an XML doc comment; no attribute was added. The four decision types' using directives are `System`, `System.Collections.Generic`, `System.Collections.ObjectModel`, `System.Globalization`, `System.Threading.Tasks`, and `UtilitiesCS` — no `Microsoft.Office.*` and no `Microsoft.Office.Interop.Outlook`. The single new Office-typed member is `EngineCommand_GetEnabled` on the pre-existing shim. |
+| AC28 | PASS | Grep over `TaskMaster.Test/Ribbon/*.cs` for `Thread.Sleep`, `Task.Delay`, `DateTime.Now`, `DateTime.UtcNow`, `Path.GetTempPath`, `new Form`, `MessageBox`, and `Application.Run` returns no match. The one asynchronous-completion test drives a `TaskCompletionSource` the test completes synchronously. The BannedApiAnalyzers stage is part of the analyzer build that returns exit 0. |
+| AC29 | PASS | The criterion prescribes verification "by the recorded promotion receipts", and those receipts are present and complete: `evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md` maps each research section 9 defect to an issue number (#504-#508) and a local entry, and all five local entries appear in the branch diff under `docs/features/potential/promoted/`. Independently confirmed that none was fixed inside #503: `RibbonController.Intelligence.cs` and `UtilitiesCS.Test/` do not appear in the diff at all, and the `*_GetPressed` and `*Enabled_Click` members were relocated with their signatures and bodies unchanged. Sub-note: the GitHub CLI is unavailable in this environment, so the existence of issues #504-#508 on GitHub is UNVERIFIED for that stated environmental reason; the in-repo half of the criterion is fully verified. |
+| AC30 | PASS | `spec.md` carries `Status: Delivered`, a `## Delivery Notes and Deviations` section recording four deviations (notification presentation, scoped rather than repo-wide formatting, the `UiThread` namespace correction, and three null-forgiving annotations), and a `## Correction Log` recording five corrections applied to `issue.md` on the research artifact's authority. `issue.md` carries a matching `## Delivered Outcome (2026-08-08)` section. `plan.2026-08-08T11-59.md` is present. The AC19-AC21 maintainer checklist is present at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md`. The stray `</content>`/`</invoke>` trailer noted in the promotions artifact is no longer present in `spec.md`; that observation is stale. |
+
+Verdict distribution: **27 PASS, 0 PARTIAL, 0 FAIL, 3 UNVERIFIED.**
+
+## Summary
+
+The delivered change satisfies every automatable acceptance criterion in `spec.md`. All 27 criteria marked `[x]` were independently re-verified this session by source inspection, direct grep over the branch diff, re-running the four toolchain stages, re-running the 69 tests in the affected namespace, and re-deriving every coverage figure from the committed JaCoCo summaries rather than accepting the executor's tabulated values.
+
+Two verification results are worth highlighting because they were obtained independently of the executor's own evidence. First, the claim that all four new decision types reach 100% line coverage is corroborated by a package-level identity that does not depend on the per-class detail removed in commit `d0955dc4`: the `TaskMaster` package's missed-line count is identical across the baseline and final measurements while its covered count rose by exactly 186, the precise line total of the four new types. Second, the claim that the six new production files are nullable-clean was confirmed by a forced project rebuild that surfaces 195 errors the mandated incremental gate cannot see, none of them in authored code.
+
+The three unverified criteria are unverified by design rather than by omission. AC19, AC20, and AC21 require a live Outlook process and a live mail profile; the repository's unit-test policy prohibits automated tests from depending on external processes, and this repository has no Outlook UI-automation harness. They are correctly left unchecked in `spec.md`, and the criteria themselves state that they must never be checked off on the strength of unit tests. A maintainer checklist exists and carries `Status: PENDING MAINTAINER EXECUTION`. AC21 is the only check that can prove the Office `getEnabled` callback is actually bound, since VSTO silently ignores a signature mismatch — the AC8 reflection test pins the signature but cannot prove host binding. That residual risk is materially mitigated by the defense-in-depth design: even if the callback never binds, the click guard alone makes the original defect unreachable.
+
+No acceptance criterion is FAIL or PARTIAL, so no remediation plan is required and no `remediation-inputs` artifact is produced. The recorded findings from the code review and the policy audit are follow-up items, the most substantive being a null-conditional operator that makes the AC5-named test's own assertion vacuous when the attribute is absent; the criterion remains genuinely enforced in the meantime by the AC6 set-equality assertion.
+
+**Recommendation: conditional GO for PR.** The single named pre-merge condition is maintainer execution of `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` against a live Outlook profile, with the outcome recorded under `evidence/manual-verification/`. `spec.md` already names this as a pre-merge step under `## Rollout & Follow-up`.
+
+## Acceptance Criteria Check-off
+
+Protocol applied: `.claude/skills/acceptance-criteria-tracking/SKILL.md`. Only criteria evaluated PASS may be checked off; UNVERIFIED criteria are left unchecked with the gap documented.
+
+- Criteria evaluated PASS: 27 (AC1-AC18, AC22-AC30). All 27 were already marked `- [x]` in `spec.md` by the executor. No check-off action was required and **no modification was made to `spec.md` by this review.**
+- Criteria evaluated UNVERIFIED: 3 (AC19, AC20, AC21). All three remain `- [ ]`, which is the correct state. This review did not check them off, and doing so on the strength of the automated evidence would violate their own text.
+- Newly checked off by this review: **none**.
+- Phantom criteria added: **none**. No acceptance criterion was created, reworded, or removed.
+
+### Acceptance Criteria Status
+
+- Source: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md`
+- Total AC items: 30
+- Checked off (delivered): 27
+- Remaining (unchecked): 3
+- Items remaining:
+  - **AC19 (R5b, A3) — MANUAL-ONLY.** Live-Outlook click of each of the eight engine-backed commands during initialization, confirming no `NullReferenceException`, no `KeyNotFoundException`, and a visible "still loading" indication.
+  - **AC20 (R5b, A2, A3) — MANUAL-ONLY.** Live-Outlook confirmation that, after `InitAsync()` completes, each of the eight commands behaves exactly as it did before this change.
+  - **AC21 (R5c, A4) — MANUAL-ONLY.** Live-Outlook confirmation that Office greys the eight buttons during initialization and re-enables them after the post-`InitAsync()` invalidation, without an add-in restart.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T15-40.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T15-40.md
new file mode 100644
index 000000000..1020a57bc
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/feature-audit.2026-08-08T15-40.md
@@ -0,0 +1,114 @@
+# Feature Audit — ribbon-engine-readiness-guard (Issue #503)
+
+- Audit timestamp: 2026-08-08T15-40
+- Cycle: **re-audit following remediation cycle 1**
+
+## Scope and Baseline
+
+- Base branch: `main`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2` (recomputed in-session with `git merge-base HEAD origin/main`, not taken on trust from the caller)
+- Feature branch: `bug/ribbon-engine-readiness-guard-503`
+- Head: `85ff0ee4f0579a3622f2da3a21a6e942b3e4cd12`
+- Work mode marker in `issue.md`: `- Work Mode: full-bug`
+- Resolved AC source: **`spec.md` only** (per `.claude/skills/acceptance-criteria-tracking/SKILL.md`; `full-bug` excludes `user-story.md`, and no `user-story.md` exists for this issue)
+- Baseline comparison: full branch diff versus the merge-base, comprising 13 `.cs`, 1 `.xml`, 2 `.csproj`, and 107 documentation/evidence files
+
+Cycle 1 changed exactly one source file (`TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs`, +12/-3) and altered no acceptance criterion's state. Every criterion below was nonetheless re-evaluated against the current tree rather than carried forward from the prior audit.
+
+## Acceptance Criteria Inventory
+
+`spec.md` `## Acceptance Criteria` defines **30** criteria, AC1 through AC30, in markdown checkbox form.
+
+| Group | Criteria | Requirement traceability |
+|---|---|---|
+| Readiness signal | AC1–AC4 | R1 |
+| Ribbon XML wiring and callback binding | AC5–AC9 | R2 |
+| Click guards and notification | AC10–AC14 | R3, A1 |
+| Protected-path preservation | AC15, AC16 | R4, R6, A2 |
+| Post-initialization refresh | AC17, AC18 | R5c, A4 |
+| Live-Outlook verification (**MANUAL-ONLY**) | AC19–AC21 | R5b, R5c, A2, A3, A4 |
+| Toolchain, coverage, file size | AC22–AC25 | R5a |
+| Structural guarantees | AC26–AC28 | architecture and determinism |
+| Process | AC29, AC30 | scope discipline and documentation |
+
+Three criteria (AC19, AC20, AC21) are explicitly designated MANUAL-ONLY by the spec, which states they "must **never** be checked off on the strength of unit tests".
+
+## Acceptance Criteria Evaluation
+
+| AC | Verdict | Evidence |
+|---|---|---|
+| AC1 | PASS | `EngineReadinessGate.cs` exists, is `internal sealed` (line 30), carries no `[ExcludeFromCodeCoverage]` attribute (only a doc comment stating it is deliberately absent), imports only `System` and `UtilitiesCS`, and implements all four readiness conditions at lines 78-101 |
+| AC2 | PASS | Named tests cover every listed case: null accessor, null `InboxEngines`, empty dictionary, missing key, null value, and a `[DataTestMethod]` over null/empty/whitespace. `IsEngineReady_IsOrdinalCaseSensitive` asserts `"spam"` is not `"Spam"` |
+| AC3 | PASS | `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` mutates the same `ConcurrentDictionary` between two calls; no `Thread.Sleep` or `Task.Delay` present. Source confirms nothing is cached — every query re-invokes the accessor |
+| AC4 | PASS | `Constructor_WithNullAccessor_ThrowsArgumentNullException`, asserting `WithParameterName("enginesAccessor")`; source line 47-48 |
+| AC5 | PASS | All eight `<button>` elements carry `getEnabled="EngineCommand_GetEnabled"`, verified directly in the XML diff. **The verifying assertion is now non-vacuous** — this is the F1 remediation, independently re-verified (see below) |
+| AC6 | PASS | `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` asserts set equality against the catalog. The XML diff confirms `menu id="OtherSpamActions"`, `menu id="OtherTriageActions"`, and every `group`/`tab` are unmodified |
+| AC7 | PASS | `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` asserts each catalog id resolves to a `button` |
+| AC8 | PASS | `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` pins public, instance, `bool` return, single `Microsoft.Office.Core.IRibbonControl` parameter. Source: `RibbonViewer.EngineCommands.cs:38-39` |
+| AC9 | PASS | `EngineCommandCatalog.Map` contains exactly eight entries — `Spam` ×3, `Triage` ×5 — built with `StringComparer.Ordinal`; `TryGetEngineName` returns `false` for null/empty; `ControlIds` is a `ReadOnlyCollection` over the dictionary keys, so duplicate-free by construction |
+| AC10 | PASS | Source inspection of all eight handlers in `RibbonViewer.EngineCommands.cs` confirms every engine dereference sits inside a `Func<Task>` lambda passed to `RunEngineCommandAsync`. `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` asserts `invoked` is false |
+| AC11 | PASS | Both exception types covered by separate named tests: `..._DoesNotThrowNullReferenceException` and `..._DoesNotThrowKeyNotFoundException`, the latter reproducing the dictionary-indexer shape |
+| AC12 | PASS | `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName` asserts `ContainSingle()` and that the message contains both `"TriageSetA"` and `"Triage"`. No `Form`, `MessageBox`, or message pump in the test |
+| AC13 | PASS | `RunAsync_WithNullAction_ThrowsArgumentNullException` (also asserting no notification is emitted, proving the precondition precedes the gate query) and `RunAsync_WithUnknownControlId_DoesNotInvokeAction` |
+| AC14 | PASS | `RunAsync_WhenActionThrows_PropagatesException`. Grep over all added `.cs` lines for `catch` returns only XML-doc prose — zero new catch clauses anywhere in the diff |
+| AC15 | PASS | `git diff --numstat <merge-base>..<head>` over `AppItemEngines.cs` and `IAppItemEngines.cs` returns **empty output**. Verified independently in this session. `ApplicationGlobals.cs` likewise zero-line |
+| AC16 | PASS | Diffed all eight handlers against the merge-base: every relocated expression is character-for-character identical inside the lambda. `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` and `RunAsync_WhenEngineReady_AwaitsActionToCompletion` (driven by a synchronously completed `TaskCompletionSource`) |
+| AC17 | PASS | `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` uses `BeEquivalentTo` (set equality, not sequence) plus a count assertion; `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException` |
+| AC18 | PASS | `RibbonViewer.EngineCommands.cs:63-81` returns early when `_ribbon` is null and marshals through `UiThread.Dispatcher` with a `CheckAccess()` guard. `ThisAddIn.cs:77-82` invokes `RefreshEngineCommands()` exactly once, immediately after `await _globals.LoadAsync(false)`, with a why-comment |
+| **AC19** | **UNVERIFIED (MANUAL-ONLY, by design)** | Requires a live Outlook process and mail profile. Checklist present at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md`, `Status: PENDING MAINTAINER EXECUTION`. Correctly left unchecked |
+| **AC20** | **UNVERIFIED (MANUAL-ONLY, by design)** | As AC19 |
+| **AC21** | **UNVERIFIED (MANUAL-ONLY, by design)** | As AC19. Office's callback-caching behaviour is internal to the host and not locally observable |
+| AC22 | PASS | Format gate **re-executed in this session**: `csharpier check .` exit 0 over 1498 files. Analyzer build exit 0 (warnings match the merge-base baseline), nullable build exit 0, 6338/6338 tests passed with 0 failed and 0 skipped, all five steps in one uninterrupted pass with a fingerprint proof of no intervening source change. Restart history disclosed rather than omitted |
+| AC23 | PASS | All four new types at **100%** line coverage against a 90% floor. Independently corroborated: the `TaskMaster` package gained exactly 186 valid lines (= 48+48+72+18) and covered all 186, with `missed` byte-identical at 1464 |
+| AC24 | PASS | Merge-base baseline captured under `evidence/baseline/` before implementation; comparison recorded. Line rate 85.8477% → 85.8561%, branch 79.2370% → 79.2702% — both **up**. No changed line lost coverage. Absolute repo-wide figure recorded and reported as required |
+| AC25 | PASS (with recorded exception) | Every changed `.cs` file measured under 500 lines; `RibbonViewer.cs` split from 487 to 388. `RibbonExplorer.xml` at 539 is the pre-existing 519-line exception the criterion itself accepts and declines to remediate; the +20 growth was independently verified as formatter-mandated |
+| AC26 | PASS | Grep over the four new decision files for `[ExcludeFromCodeCoverage]` returns only XML-doc prose stating the attribute is deliberately absent — zero actual attributes |
+| AC27 | PASS | Grep confirms zero real `Microsoft.Office.*` references in the four decision types (all matches are doc prose). The single new Office-typed member is `EngineCommand_GetEnabled` on the pre-existing `RibbonViewer`. No new `[ComVisible(true)]` attribute added |
+| AC28 | PASS | Grep over the five new/changed test files for temp-file APIs, `Thread.Sleep`, `Task.Delay`, wall-clock reads, `Form`, `MessageBox`, and message-pump entry points returns zero matches |
+| AC29 | PASS | Six entries under `docs/features/potential/promoted/` covering the research §9 defects (orphan callbacks, `getPressed` signatures, fire-and-forget `ToggleEngineAsync`, non-null-safe `RibbonController.Engines`) plus two found during execution. None fixed inside #503 |
+| AC30 | PASS | `spec.md` carries `## Delivery Notes and Deviations` with four disclosed deviations and a `## Remediation Cycle 1` section; `issue.md` carries `## Delivered Outcome`; the manual checklist is present with outcomes pending |
+
+### F1 re-verification (AC5's supporting assertion)
+
+The prior review found AC5's verifying test vacuous: `...Attribute("getEnabled")?.Value.Should().Be(...)` short-circuits the entire chain including `.Should()` when the attribute is absent, so the test passed silently on exactly the regression it names. The criterion was substantively satisfied by the XML itself, but its stated verification method was not sound.
+
+Current source binds the attribute first and asserts `NotBeNull` before dereferencing (`RibbonExplorerXmlTests.cs:201-214`). The remediation was proven, not asserted: the mutation was applied to the embedded resource inside the built assembly with the attribute count verified at 7 in the DLL before any test ran, a green control run against the unmutated resource is recorded, the test was recorded **Failed** with a verbatim message naming `NotBeNull` at line 202, and the mutation was restored with the test recorded **Passed**. The permanent tree retains no part of the mutation, confirmed independently via `git hash-object`.
+
+AC5 is now backed by a genuinely non-vacuous assertion.
+
+### F2 disposition (bears on AC25)
+
+F2 asked that the three `TriageSet*` buttons be restored to single-line form while retaining `getEnabled`, targeting 527 lines. The executor reported this as not remediable. That claim was **independently reproduced in this session** rather than accepted: CSharpier 1.3.0 formats XML, `.csharpierignore` contains no `*.xml` exclusion, no `.csharpierrc` exists so the print width is 100, the collapsed form measures 116 characters, and running `csharpier check` against a probe document containing that exact collapsed element reports it unformatted while leaving a 78-character sibling untouched. AC25's accepted-exception clause therefore stands unchanged, and F2 is correctly closed as escalated rather than fixed.
+
+## Summary
+
+**27 of 30 acceptance criteria PASS.** Zero criteria are FAIL or PARTIAL. Three (AC19, AC20, AC21) are UNVERIFIED by design because they require a live Outlook profile that cannot exist in this environment, and the spec forbids checking them off on the strength of unit tests.
+
+Remediation is **not** triggered. The SKILL's remediation conditions require a meaningful FAIL or PARTIAL result, a failing toolchain gate, a code-review blocker, an acceptance criterion at FAIL or PARTIAL, a coverage threshold breach, or a missing coverage artifact. None applies: every automated criterion passes, all four toolchain gates pass, the code review records no blocker, coverage clears every applicable floor, and the canonical coverage artifact is present and current for HEAD.
+
+AC19–AC21 are deliberately excluded from that trigger. They are not unmet work awaiting a plan; they are a maintainer verification step that no automated executor could perform, since the repository has no Outlook UI-automation harness and the unit-test policy prohibits tests depending on external processes. Routing them to a remediation planner would generate a plan nothing could execute. They are instead recorded as a pre-merge gate, which is exactly how `spec.md` Rollout already frames them.
+
+**Recommendation: GO for PR**, conditional on the maintainer executing `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` against a live Outlook profile before merge.
+
+## Acceptance Criteria Check-off
+
+No check-off changes were made to `spec.md` by this review.
+
+- All 27 automated criteria evaluated PASS were **already** checked `[x]` by the implementation cycle. No previously-unchecked criterion became eligible.
+- AC19, AC20, and AC21 remain `[ ]` and **must not** be checked by this reviewer. The spec states they must never be checked off on the strength of unit tests, and no live-Outlook evidence exists. Marking them would be a false attestation.
+
+The reviewer's check-off obligation under `acceptance-criteria-tracking` is therefore satisfied with zero edits to the AC source file.
+
+### Acceptance Criteria Status
+
+```
+### Acceptance Criteria Status
+- Source: docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
+- Total AC items: 30
+- Checked off (delivered): 27
+- Remaining (unchecked): 3
+- Items remaining:
+  - AC19 (R5b, A3) — MANUAL-ONLY: live-Outlook click of the eight commands during initialization produces no NullReferenceException or KeyNotFoundException and shows the "still loading" indication
+  - AC20 (R5b, A2, A3) — MANUAL-ONLY: after InitAsync() completes, each of the eight commands behaves exactly as before this change
+  - AC21 (R5c, A4) — MANUAL-ONLY: Office visually greys the eight buttons during initialization and re-enables them after the post-InitAsync invalidation, without an add-in restart
+```
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md
new file mode 100644
index 000000000..25b2f674c
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md
@@ -0,0 +1,109 @@
+# ribbon-engine-readiness-guard (Issue #503)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/ (Issue #503)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #503
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/503
+- Last Updated: 2026-08-08
+- Work Mode: full-bug
+
+## Summary
+
+SpamBayes-dependent ribbon commands are invokable before `AppItemEngines.InitAsync()` has populated `Globals.Engines.InboxEngines`. `RibbonController.SB` returns `null` during that window, so `RibbonViewer.TrainSpam_Click` dereferences null and throws a `NullReferenceException`. The same initialization race affects every ribbon command backed by an engine in `InboxEngines` (Triage, Project, Context, Actionable).
+
+## Environment
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8, TaskMaster VSTO add-in
+- Command/flags used: Outlook Explorer ribbon, "Train Spam" button clicked immediately after add-in reload
+- Data source or fixture: Live Outlook profile; `Globals.AF.Manager.Configuration` still resolving
+
+## Steps to Reproduce
+
+1. Reload the TaskMaster add-in (or restart Outlook) so `AppItemEngines.InitAsync()` begins.
+2. Before `InitAsync()` completes, click the "Train Spam" ribbon button in the Explorer ribbon.
+3. Observe the failure in `RibbonViewer.TrainSpam_Click`.
+
+## Expected Behavior
+
+Engine-dependent ribbon commands are not invokable until their backing engine in `InboxEngines` is available. Clicking a not-yet-ready command produces no exception; once `InitAsync()` completes, the commands become enabled and behave exactly as they do today.
+
+## Actual Behavior
+
+`RibbonController.SB` evaluates `Globals?.Engines?.InboxEngines?.TryGetValue("Spam", out var engine)` against an empty `ConcurrentDictionary` and returns `null`. `RibbonViewer.TrainSpam_Click` then executes `await Controller.SB.TrainAsync(Controller.OlSelection, true)`, which throws `NullReferenceException`. Because the handler is `async void`, the exception surfaces on the message-pump synchronization context rather than at the call site.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet:
+
+```text
+System.NullReferenceException: Object reference not set to an instance of an object.
+   at TaskMaster.RibbonViewer.TrainSpam_Click(IRibbonControl control)
+```
+
+Relevant source:
+
+- `TaskMaster/Ribbon/RibbonViewer.cs` (`TrainSpam_Click`, ~line 255-256)
+- `TaskMaster/Ribbon/RibbonController.Intelligence.cs` (`SB` property, ~line 190-202)
+- `TaskMaster/AppGlobals/AppItemEngines.cs` (`InitAsync`, `InboxEngines`)
+
+## Impact / Severity
+
+- [ ] Blocker
+- [x] High
+- [ ] Medium
+- [ ] Low
+
+An unhandled `NullReferenceException` on a routine ribbon click immediately after add-in reload. The window is short but reliably reachable, and the failure mode is a silent/unhandled async-void throw rather than a recoverable message.
+
+## Suspected Cause / Notes
+
+`InboxEngines` is initialized to an empty `ConcurrentDictionary` at field-initializer time and is only populated at the end of `InitAsync()`, which first awaits `Globals.AF.Manager.Configuration` and then asynchronously constructs each engine (`SpamBayes.CreateEngineAsync`, `Triage.CreateEngineAsync`, `CategoryClassifierGroup.CreateEngineAsync`, `ActionableClassifierGroup.CreateEngineAsync`). There is no published readiness signal on `AppItemEngines`/`IAppItemEngines`, and the Explorer ribbon XML declares no `getEnabled` callback for the engine-backed buttons, so the ribbon has no way to reflect initialization progress.
+
+`RibbonViewer.TestSpam_Click` has the same defect in a more direct form: it indexes `Controller.Engines.InboxEngines[SpamBayes.GroupName]` and will throw `KeyNotFoundException` during the same window.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: readiness signal on `AppItemEngines`/`IAppItemEngines`; `RibbonController` engine-readiness predicate; `RibbonViewer` click-handler guards; `RibbonExplorer.xml` `getEnabled` wiring validated by the existing ribbon-XML regression suite.
+- [x] Integration scenario to retest: click each engine-backed ribbon command immediately after add-in reload; confirm no exception and confirm normal behavior after `InitAsync()` completes.
+- [x] Manual verification notes: verify `Ribbon.InvalidateControl(...)`/`Invalidate()` refreshes the enabled state once initialization finishes.
+
+Constraints to honor:
+
+- Do not change the async engine construction logic, config loading, or dictionary population order inside `AppItemEngines.InitAsync()`.
+- Preserve existing `SB`/`TrainAsync` behavior once engines are loaded.
+
+## Next Step
+
+- [x] Promote to GitHub issue (bug-report template)
+- [x] Move to active fix folder / branch
+
+## Delivered Outcome (2026-08-08)
+
+Status: **Delivered** on branch `bug/ribbon-engine-readiness-guard-503` (merge-base `003c5715055d7d1933db68a742531332756e30b2`). Full delivery notes and deviations are in `spec.md` under `## Delivery Notes and Deviations`.
+
+The initialization race is closed by a per-engine-key readiness signal computed from the existing `IAppItemEngines.InboxEngines` member, implemented in four new host-neutral types under `TaskMaster\Ribbon\` that are deliberately not `[ExcludeFromCodeCoverage]`:
+
+- `EngineCommandCatalog` — the single control-id to engine-key map (8 entries).
+- `EngineReadinessGate` — the per-key readiness predicate, recomputed on every query.
+- `EngineGatedCommandRunner` — the `getEnabled` decision and the click guard; defers the engine dereference into a `Func<Task>` lambda.
+- `EngineCommandRefreshPlanner` — the post-initialization invalidation set.
+
+Wiring: `getEnabled="EngineCommand_GetEnabled"` on the eight engine-backed `<button>` elements in `RibbonExplorer.xml`; one new Office-typed shim `public bool EngineCommand_GetEnabled(Office.IRibbonControl)` on a new `RibbonViewer` partial; one refresh call in `ThisAddIn.cs` immediately after `await _globals.LoadAsync(false)`, marshalled explicitly through `UiThread.Dispatcher`.
+
+Corrections to this issue's original text, established by research and carried into `spec.md`:
+
+- The affected set is exactly **eight** handlers (`Spam` x3, `Triage` x5), not "every engine in `InboxEngines`". No ribbon callback dereferences the `Project`, `Context`, or `Actionable` engines.
+- `TestSpam_Click` throws `KeyNotFoundException` (dictionary indexer), not `NullReferenceException`. Both types are covered by the regression tests.
+- The readiness signal is **not** added to `AppItemEngines` / `IAppItemEngines`: .NET Framework 4.8.1 has no default interface members, so any new interface member could only be bodied inside the `[ExcludeFromCodeCoverage]` `AppItemEngines` and would be uncoverable. Both files take a **zero-line diff**, which is stronger R4 compliance than the original phrasing required.
+
+Constraints honoured: `AppItemEngines.InitAsync()` untouched; `SB`/`Triage`/`TrainAsync` ready-path expressions byte-identical to before.
+
+Verification: 6338 tests pass (up from 6293), zero failed, zero skipped. All four new types at 100% line coverage. `csharpier check .` exit 0 over 1498 files; analyzer build 0 errors; nullable build 0 errors. Evidence under `evidence/baseline/`, `evidence/regression-testing/`, `evidence/qa-gates/`, `evidence/manual-verification/`, and `evidence/issue-updates/`.
+
+Outstanding: AC19, AC20, AC21 are MANUAL-ONLY and remain unchecked pending maintainer execution of `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` against a live Outlook profile.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/plan.2026-08-08T11-59.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/plan.2026-08-08T11-59.md
new file mode 100644
index 000000000..e0fff9474
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/plan.2026-08-08T11-59.md
@@ -0,0 +1,378 @@
+# ribbon-engine-readiness-guard — Atomic Implementation Plan (Issue #503)
+
+- **Issue:** #503
+- **Parent (optional):** none
+- **Owner:** drmoisan
+- **Last Updated:** 2026-08-08T11-59
+- **Status:** Executed
+- **Version:** 1.0
+- **Work Mode:** `full-bug` (persisted in `issue.md`; AC source is `spec.md` only, per `.claude/skills/acceptance-criteria-tracking/SKILL.md`)
+- **Branch:** `bug/ribbon-engine-readiness-guard-503`
+- **Base:** `main`
+- **Merge-base:** `003c5715055d7d1933db68a742531332756e30b2`
+- **Feature folder:** `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\`
+
+**Fail-closed evidence rule:** Every baseline, QA-gate, regression, and coverage-comparison artifact named in this plan is mandatory. If any required artifact is missing or is missing a required field, the outcome is BLOCKED or INCOMPLETE, never PASS.
+
+**Evidence accounting rule:** Each evidence-producing task names its exact artifact path. Do not mark an evidence-backed task complete without the artifact on disk.
+
+**Evidence location invariant:** All evidence artifacts are written under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/<kind>/`. The non-canonical evidence sub-paths enumerated as FORBIDDEN in `.claude/skills/evidence-and-timestamp-conventions/SKILL.md` are prohibited here and are blocked at write time by the `enforce-evidence-locations.ps1` PreToolUse hook; this plan names none of them as an output location. No non-canonical evidence path was supplied by the caller, so no `EVIDENCE_LOCATION_OVERRIDE_REJECTED` record is required for this plan.
+
+---
+
+## 1. Objective and expected outcome
+
+Close the initialization race in which the eight engine-backed Explorer-ribbon commands are invokable before `AppItemEngines.InitAsync()` has populated `Globals.Engines.InboxEngines`, so a click during that window throws `NullReferenceException` (`Controller.SB` / `Controller.Triage` paths) or `KeyNotFoundException` (the `TestSpam_Click` dictionary-indexer path) out of an `async void` handler.
+
+Expected outcome: a per-engine-key readiness signal computed from the existing `IAppItemEngines.InboxEngines` member, implemented in four new host-neutral `internal sealed` types that are deliberately NOT `[ExcludeFromCodeCoverage]`; `getEnabled` wiring on the eight `<button>` elements; a defense-in-depth click guard that defers the engine dereference into a lambda; and one post-initialization ribbon refresh marshalled to the STA. `TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` take a zero-line diff.
+
+---
+
+## 2. Path and token conventions
+
+| Token | Value |
+|---|---|
+| `<REPO>` | `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55` |
+| `<FEATURE>` | `<REPO>\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503` |
+| `<MERGE_BASE>` | `003c5715055d7d1933db68a742531332756e30b2` |
+| `<TS>` | ISO-8601 capture timestamp in `yyyy-MM-ddTHH-mm` form, substituted at write time (for example `2026-08-08T14-05`) |
+| `<CSHARPIER>` | `C:\Users\DanMoisan\.dotnet\tools\csharpier.exe` |
+| `<MSBUILD>` | `C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe` |
+| `<VSTEST>` | `C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` |
+
+Every evidence artifact carries, at minimum: `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:`. Test artifacts additionally carry numeric coverage headline values (`line-rate`, `branch-rate`, `lines-covered`, `lines-valid`).
+
+---
+
+## 3. Fixed execution rules (binding on every task in this plan)
+
+1. **Shell.** Every C# toolchain command runs through `pwsh -NoProfile -Command` or `pwsh -NoProfile -File`. Never invoke MSBuild, vstest, csharpier, or nuget through the Bash tool: the Bash tool is Git Bash and rewrites MSBuild `/switch` arguments into paths (`/m` becomes `M:/`, producing `error MSB1008`). This is a hard requirement.
+2. **Restore first.** A clean build fails with CS0246 on `log4net` / `SvgDocument` until `nuget restore TaskMaster.sln` has run. Run the restore (P0-T5) before any build.
+3. **Absolute tool paths.** `csharpier`, `MSBuild.exe`, and `vstest.console.exe` are not on PATH. Use `<CSHARPIER>`, `<MSBUILD>`, `<VSTEST>` exactly as tabulated above. `nuget` is on PATH.
+4. **CSharpier subcommands only.** Formatting gates use `csharpier format <paths>` (mutates on disk) followed by `csharpier check` returning `EXIT_CODE: 0`. `csharpier pipe-files` is prohibited as a gate: it writes to stdout only, never mutates, and produces a false "stable" result.
+5. **CSharpier scope guard.** `csharpier format` is invoked with the explicit scope-locked `.cs` path list from section 4 and is NEVER invoked repo-wide, and NEVER with `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` in its argument list. Reason: a repo-wide `csharpier format .` would reformat any file that is unformatted at the merge-base, which would break the AC15 zero-line-diff requirement. `csharpier check .` (read-only) is still run repo-wide as the comparison gate.
+6. **Legacy csproj wiring is mandatory and is part of each file-creation task.** `TaskMaster\TaskMaster.csproj` and `TaskMaster.Test\TaskMaster.Test.csproj` are non-SDK `packages.config` projects that enumerate every source file with an explicit `<Compile Include>` item and no glob. A new `.cs` file WILL NOT COMPILE into the assembly without its own `<Compile Include>` entry. Each file-creation task below has a single binary outcome that includes both the file and its csproj entry. Do not add a `<Compile Include>` entry before its target file exists — MSBuild fails the build when a `Compile` item points at a missing file.
+7. **Pre-existing baseline failure handling.** The merge-base test suite is NOT green. `YieldAsync_WithoutDispatcher_RemainsStrict` in `UtilitiesCS.Test\OutlookObjects\Folder\WpfDispatcherYieldTests.cs` is a pre-existing order-dependent flake already promoted to issue **#508** and is explicitly OUT OF SCOPE for #503. A final-QC test run counts as passing when the ONLY failures are members of the pre-existing set recorded in P0-T10. Do not attempt to fix #508. Any NEW failure is a real regression: fix it and restart the Phase 6 loop from P6-T1.
+8. **No HEAD SHA is pinned as a plan expectation.** P0-T4 records the current HEAD for the audit trail. All later gates are expressed as tree invariants (clean `git status --porcelain`, and no `.cs` / `.csproj` / `.xml` diff outside the scope lock relative to `<MERGE_BASE>`), never as equality against a recorded SHA.
+9. **One acceptance criterion per check-off task.** Phase 7 check-off tasks each flip exactly one `- [ ]` to `- [x]` in `<FEATURE>\spec.md`, with that criterion's own evidence pointer. Batched check-offs are prohibited.
+10. **AC19, AC20, AC21 are MANUAL-ONLY.** They must be left `- [ ]` in `spec.md`. They must NOT be checked off on the strength of unit tests, source inspection, or any automated artifact. Their outcome is recorded as a maintainer checklist under `<FEATURE>\evidence\manual-verification\`.
+11. **Non-AC checkboxes are not acceptance criteria.** The `- [ ] Blocker` / `- [x] High` / `- [ ] Medium` / `- [ ] Low` checkboxes under `## Impact / Severity` in `spec.md` and `issue.md` are severity markers, not acceptance criteria. Do not modify them.
+12. **No new `catch (Exception)`.** The guard suppresses invocation, never errors. Exceptions thrown by a ready action propagate unchanged.
+
+---
+
+## 4. Scope lock
+
+Only the paths below may be created or modified. Any change outside this list is out of scope and must be reported rather than made.
+
+#### 4.1 New production files (`TaskMaster` assembly, namespace `TaskMaster`)
+
+| Path | Type shape | Predicted lines |
+|---|---|---|
+| `TaskMaster\Ribbon\EngineCommandCatalog.cs` | `internal static` map (no `[ExcludeFromCodeCoverage]`) | ~75 |
+| `TaskMaster\Ribbon\EngineReadinessGate.cs` | `internal sealed` (no `[ExcludeFromCodeCoverage]`) | ~85 |
+| `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | `internal sealed` (no `[ExcludeFromCodeCoverage]`) | ~90 |
+| `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | `internal static` (no `[ExcludeFromCodeCoverage]`) | ~45 |
+| `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` | new partial of the existing `[ExcludeFromCodeCoverage] partial class RibbonController` | ~75 |
+| `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` | new partial of `RibbonViewer` | ~150 |
+
+#### 4.2 Modified production files
+
+| Path | Change | Merge-base lines |
+|---|---|---|
+| `TaskMaster\Ribbon\RibbonViewer.cs` | line 33 `public class` becomes `public partial class`; `#region Spam Manager` (250-296) and `#region Triage` (298-347) relocated out | 487 |
+| `TaskMaster\Ribbon\RibbonExplorer.xml` | `getEnabled="EngineCommand_GetEnabled"` added to eight `<button>` elements | 519 (pre-existing overage) |
+| `TaskMaster\ThisAddIn.cs` | one refresh statement plus a why-comment after `await _globals.LoadAsync(false);` (line 76) | 300 |
+| `TaskMaster\TaskMaster.csproj` | six `<Compile Include>` entries in the `ItemGroup` containing lines 459-463 | — |
+
+#### 4.3 New and modified test files (`TaskMaster.Test` assembly, namespace `TaskMaster.Test.Ribbon`)
+
+| Path | Change |
+|---|---|
+| `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` | new |
+| `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs` | new |
+| `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs` | new |
+| `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs` | new |
+| `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | extended with four assertions (161 lines at merge-base) |
+| `TaskMaster.Test\TaskMaster.Test.csproj` | four `<Compile Include>` entries in the `ItemGroup` containing lines 311-313 |
+
+#### 4.4 Files that must take a ZERO-LINE DIFF
+
+- `TaskMaster\AppGlobals\AppItemEngines.cs`
+- `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs`
+- `TaskMaster\AppGlobals\ApplicationGlobals.cs`
+
+#### 4.5 Scope-locked `.cs` path list for `csharpier format`
+
+```
+TaskMaster\Ribbon\EngineCommandCatalog.cs
+TaskMaster\Ribbon\EngineReadinessGate.cs
+TaskMaster\Ribbon\EngineGatedCommandRunner.cs
+TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs
+TaskMaster\Ribbon\RibbonController.EngineCommands.cs
+TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs
+TaskMaster\Ribbon\RibbonViewer.cs
+TaskMaster\ThisAddIn.cs
+TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs
+TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs
+TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs
+TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs
+```
+
+#### 4.6 Exact csproj items to add
+
+`TaskMaster\TaskMaster.csproj` (into the `ItemGroup` containing `<Compile Include="Ribbon\RibbonController.cs" />` at line 459):
+
+```xml
+<Compile Include="Ribbon\EngineCommandCatalog.cs" />
+<Compile Include="Ribbon\EngineCommandRefreshPlanner.cs" />
+<Compile Include="Ribbon\EngineGatedCommandRunner.cs" />
+<Compile Include="Ribbon\EngineReadinessGate.cs" />
+<Compile Include="Ribbon\RibbonController.EngineCommands.cs" />
+<Compile Include="Ribbon\RibbonViewer.EngineCommands.cs" />
+```
+
+`TaskMaster.Test\TaskMaster.Test.csproj` (into the `ItemGroup` containing `<Compile Include="Ribbon\RibbonControllerTests.cs" />` at line 311):
+
+```xml
+<Compile Include="Ribbon\EngineCommandCatalogTests.cs" />
+<Compile Include="Ribbon\EngineCommandRefreshPlannerTests.cs" />
+<Compile Include="Ribbon\EngineGatedCommandRunnerTests.cs" />
+<Compile Include="Ribbon\EngineReadinessGateTests.cs" />
+```
+
+---
+
+## 5. Contract specifications (pinned; do not re-derive)
+
+#### 5.1 Control-id to engine-key catalog (exactly eight entries)
+
+| Control id | Engine key | Handler |
+|---|---|---|
+| `TrainSpam` | `Spam` | `TrainSpam_Click` |
+| `TrainHam` | `Spam` | `TrainHam_Click` |
+| `TestSpam` | `Spam` | `TestSpam_Click` |
+| `TriageSetA` | `Triage` | `TriageSetA_Click` |
+| `TriageSetB` | `Triage` | `TriageSetB_Click` |
+| `TriageSetC` | `Triage` | `TriageSetC_Click` |
+| `ClearTriage` | `Triage` | `ClearTriage_Click` |
+| `FilterTriageGroup` | `Triage` | `FilterViewer_Click` |
+
+#### 5.2 Member signatures
+
+| Type | Member |
+|---|---|
+| `EngineCommandCatalog` | `internal static bool TryGetEngineName(string controlId, out string engineName)` |
+| `EngineCommandCatalog` | `internal static IReadOnlyCollection<string> ControlIds { get; }` |
+| `EngineReadinessGate` | `internal EngineReadinessGate(Func<IAppItemEngines> enginesAccessor)` — null accessor throws `ArgumentNullException` |
+| `EngineReadinessGate` | `internal bool IsEngineReady(string engineName)` |
+| `EngineReadinessGate` | `internal bool TryGetEngine(string engineName, out IConditionalEngine<MailItemHelper> engine)` |
+| `EngineGatedCommandRunner` | `internal EngineGatedCommandRunner(EngineReadinessGate gate, Action<string> notifyNotReady)` — either null throws `ArgumentNullException` |
+| `EngineGatedCommandRunner` | `internal bool IsCommandEnabled(string controlId)` |
+| `EngineGatedCommandRunner` | `internal Task RunAsync(string controlId, Func<Task> action)` |
+| `EngineCommandRefreshPlanner` | `internal static void InvalidateAll(Action<string> invalidateControl)` — null delegate throws `ArgumentNullException` |
+| `RibbonViewer` | `public bool EngineCommand_GetEnabled(Office.IRibbonControl control)` |
+| `RibbonViewer` | `internal void InvalidateEngineCommands()` |
+| `RibbonController` | `internal bool IsEngineCommandEnabled(string controlId)` |
+| `RibbonController` | `internal Task RunEngineCommandAsync(string controlId, Func<Task> action)` |
+| `RibbonController` | `internal void RefreshEngineCommands()` |
+
+`IAppItemEngines`, `IConditionalEngine<T>`, and `MailItemHelper` all live in namespace `UtilitiesCS`.
+
+#### 5.3 Readiness contract
+
+Engine key `k` is ready if and only if: the accessor returns a non-null `IAppItemEngines`; `InboxEngines` is non-null; `InboxEngines.TryGetValue(k, out var e)` is `true`; and `e` is not null. String comparison is the `ConcurrentDictionary` default — ordinal and case-sensitive, so `"spam"` is not `"Spam"`. Readiness is recomputed on every query and never cached in the gate. A null or whitespace `engineName` yields `false`.
+
+#### 5.4 Runner contract
+
+`RunAsync(controlId, action)`: a null `action` throws `ArgumentNullException` before any readiness evaluation. When `IsCommandEnabled(controlId)` is `false`, emit exactly one notification through the injected `Action<string>` sink and return a completed task WITHOUT invoking `action`. Otherwise `await action()` and let any exception propagate unchanged.
+
+Notification content: for a mapped control id the message contains both the control id and the engine key. For an unmapped/unknown/null/empty control id the message contains the supplied control id (rendered as `(null)` when null) and the literal token `(unmapped)` in place of an engine key. This branch is pinned here so tests and implementation cannot disagree.
+
+#### 5.5 Readiness accessor
+
+`RibbonController.EngineCommands.cs` builds `new EngineReadinessGate(() => Globals?.Engines)`. The `?.` is what makes the pre-`SetGlobals` case safe. Do NOT use the existing `RibbonController.Engines` (`RibbonController.Intelligence.cs:204`) as the accessor — it is not null-safe on `Globals`. Do NOT route the readiness decision through `RibbonController.SB` / `Triage` / `TriageAsync`: those getters install a real `WindowsFormsSynchronizationContext` on the calling thread as a side effect.
+
+#### 5.6 Notification presentation (recorded decision, see section 9 item D3)
+
+The sink implementation lives in the `[ExcludeFromCodeCoverage]` shim and writes one `logger.Warn(message)` line through the existing log4net logger and one `MessageBox.Show(message)` call, matching the established user-facing notice mechanism already used at `RibbonViewer.cs:413`, `RibbonController.cs:80,167,189,196`, and `RibbonController.FolderTree.cs:250,263`. No `Form`, `MessageBox`, or message pump is constructed in any test; tests assert on the injected `Action<string>` sink only.
+
+---
+
+## 6. Out-of-scope defects (already promoted; do NOT re-promote and do NOT fix here)
+
+| Research §9 defect | Issue |
+|---|---|
+| Five orphan `onAction` callbacks in `RibbonExplorer.xml` (`_Clicked` vs `_Click` suffix mismatch) | **#504** |
+| Invalid `getPressed` callback signatures (`async Task<bool>` instead of `bool`) | **#505** |
+| Fire-and-forget `ToggleEngineAsync` in `SpamBayesEnabled_Click` / `TriageEnabled_Click` | **#506** |
+| `RibbonController.Engines` is not null-safe on `Globals` | **#507** |
+| Pre-existing order-dependent flake `YieldAsync_WithoutDispatcher_RemainsStrict` | **#508** |
+
+AC29 is satisfied by recording these five numbers. No promotion lifecycle call is made by this plan.
+
+---
+
+### Phase 0 — Baseline Capture and Toolchain Verification
+
+- [x] [P0-T1] Verify every required tool resolves before any other task runs. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Test-Path 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe'; (Get-Command nuget -ErrorAction SilentlyContinue) -ne $null; (Get-Command dotnet-coverage -ErrorAction SilentlyContinue) -ne $null"`. Acceptance: `<FEATURE>\evidence\baseline\toolchain-availability.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:` and records one `True`/`False` per tool. If `dotnet-coverage` reports `False`, install it with `pwsh -NoProfile -Command "dotnet tool install --global dotnet-coverage"` and record the install command and its exit code in the same artifact. Binary outcome: all five tools resolve `True` in the final state recorded by the artifact.
+- [x] [P0-T2] Read the policy files in the exact order defined by `.claude/skills/policy-compliance-order/SKILL.md`: (1) `CLAUDE.md`, (2) `.claude/rules/general-code-change.md`, (3) `.claude/rules/general-unit-test.md`, (4) `.claude/rules/csharp.md`, then `.claude/rules/architecture-boundaries.md`, `.claude/rules/quality-tiers.md`, and `.claude/rules/tonality.md`. Acceptance: `<FEATURE>\evidence\baseline\phase0-instructions-read.md` exists containing `Timestamp:`, `Policy Order:` and an explicit ordered list of every file read with its absolute path.
+- [x] [P0-T3] Read the feature inputs: `<FEATURE>\spec.md`, `<FEATURE>\issue.md`, and `<FEATURE>\research\2026-08-08T12-45-ribbon-engine-readiness-guard-research.md`. Acceptance: `<FEATURE>\evidence\baseline\phase0-inputs-read.<TS>.md` exists, records `Timestamp:` and the three absolute paths, and states the resolved work mode `full-bug` with `spec.md` named as the sole AC source and the AC count as 30 (AC1 through AC30).
+- [x] [P0-T4] Record git state for the audit trail. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git rev-parse HEAD; git status --porcelain; git rev-parse 003c5715055d7d1933db68a742531332756e30b2"`. Acceptance: `<FEATURE>\evidence\baseline\git-state.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:` recording the current HEAD SHA, the branch name `bug/ribbon-engine-readiness-guard-503`, the merge-base `003c5715055d7d1933db68a742531332756e30b2`, and the verbatim `git status --porcelain` output. At this point that output is expected to be non-empty and to contain only the pre-implementation planning artifacts under `docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\`, the promoted entries under `docs\features\potential\promoted\`, `.claude\agent-memory\` updates, and the Phase 0 evidence artifacts written by P0-T1 through P0-T3. Binary outcome: no `.cs`, `.csproj`, `.xml`, or `.sln` path appears in the porcelain output. The recorded HEAD is an audit record only and is never used as a later equality gate.
+- [x] [P0-T5] Restore NuGet packages. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; nuget restore TaskMaster.sln; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\baseline\nuget-restore.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`.
+- [x] [P0-T6] Capture the merge-base CSharpier state repo-wide, read-only. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\baseline\csharpier-check.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:` and, when the exit code is non-zero, an explicit verbatim list of every file CSharpier reports as unformatted at the merge-base. This baseline set is the comparison basis for P6-T2. Do not run `csharpier format` in this task. The merge-base value is already KNOWN rather than to-be-discovered: the orchestrator measured `csharpier check .` at `<MERGE_BASE>` as `EXIT 0` over 1488 files, so the merge-base unformatted set is empty. This task remains a real measurement task and must execute the command and record the measured result verbatim; the known value is the expected result, not a substitute for running it. If the measured result differs from `EXIT 0` / empty unformatted set, record the measured result and treat the difference as a finding.
+- [x] [P0-T7] Capture the analyzer build baseline. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\baseline\msbuild-analyzers.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:` recording the error count and warning count. Expected merge-base value is EXIT 0.
+- [x] [P0-T8] Capture the nullable/type-check build baseline. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\baseline\msbuild-nullable.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`. Expected merge-base value is EXIT 0.
+- [x] [P0-T9] Capture the full-suite test and coverage baseline. Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\baseline\coverage-baseline.cobertura.xml` run from `<REPO>`. Acceptance: both `<FEATURE>\evidence\baseline\coverage-baseline.cobertura.xml` and `<FEATURE>\evidence\baseline\tests-with-coverage.<TS>.md` exist. The `.md` artifact carries `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` containing total/passed/failed/skipped test counts and the numeric root `<coverage>` attributes `line-rate`, `branch-rate`, `lines-covered`, `lines-valid` read from the emitted XML. Expected merge-base reference values for comparison: total 6293, `line-rate` 0.7042636529201906, `branch-rate` 0.5849570138678879, `lines-covered` 56458, `lines-valid` 80166. Record the measured values verbatim even when they differ from the reference values; do not overwrite the measured values with the reference values.
+- [x] [P0-T10] Record the pre-existing failing/flaky test set and the final-QC pass rule that depends on it. Acceptance: `<FEATURE>\evidence\baseline\preexisting-failures.<TS>.md` exists, records `Timestamp:`, names each failing test observed in P0-T9 by fully-qualified name, explicitly names `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` (file `UtilitiesCS.Test\OutlookObjects\Folder\WpfDispatcherYieldTests.cs`) as a pre-existing order-dependent flake tracked by issue **#508** and out of scope for #503, and states the rule verbatim: a Phase 6 test run passes when the only failures are members of this recorded set; any test not in this set that fails is a real regression that restarts the Phase 6 loop at P6-T1; issue #508 must not be fixed inside this change.
+- [x] [P0-T11] Record the merge-base line count of every path in the section 4 scope lock that already exists. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; 'TaskMaster\Ribbon\RibbonViewer.cs','TaskMaster\Ribbon\RibbonExplorer.xml','TaskMaster\ThisAddIn.cs','TaskMaster\Ribbon\RibbonController.Intelligence.cs','TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs','TaskMaster\AppGlobals\AppItemEngines.cs','UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs' | ForEach-Object { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines }"`. Acceptance: `<FEATURE>\evidence\baseline\file-line-counts.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:` listing each path and its line count. Mark the artifact ADVISORY: the authoritative 500-line audit is P6-T3, measured after the final CSharpier format pass.
+- [x] [P0-T12] Derive and record the CSharpier formatting-scope rule from the P0-T6 result. Acceptance: `<FEATURE>\evidence\baseline\csharpier-scope-rule.<TS>.md` exists, records `Timestamp:`, restates rule 5 of section 3 verbatim, lists the thirteen scope-locked `.cs` paths from section 4.5 that P6-T1 may pass to `csharpier format`, and explicitly records whether `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` appear in the P0-T6 unformatted set. If either appears, the artifact must state that those files remain unformatted by design to preserve the AC15 zero-line diff, and that this is a recorded pre-existing condition rather than a defect introduced by #503.
+- [x] [P0-T13] Commit the pre-implementation planning artifacts and Phase 0 evidence so that HEAD advances past `<MERGE_BASE>` and all later `<MERGE_BASE>..HEAD` diffs are meaningful. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'docs(#503): planning artifacts and Phase 0 baseline evidence'; git status --porcelain; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\baseline\phase0-commit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the new HEAD SHA and an empty post-commit `git status --porcelain`. Binary outcome: HEAD is no longer equal to `<MERGE_BASE>` and porcelain is empty.
+
+---
+
+### Phase 1 — Failing Regression Test (red before green)
+
+Phase 1 deliberately leaves the solution in a non-building state. That state is the recorded red and is resolved by Phase 2.
+
+- [x] [P1-T1] [expect-fail] Create `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` in namespace `TaskMaster.Test.Ribbon` with a `[TestClass] public class EngineGatedCommandRunnerTests` containing exactly the two AC11 regression tests, and add `<Compile Include="Ribbon\EngineGatedCommandRunnerTests.cs" />` to the `ItemGroup` in `TaskMaster.Test\TaskMaster.Test.csproj` containing line 311. Test 1, `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException`: arrange an `EngineReadinessGate` over an accessor returning a `Mock<IAppItemEngines>` whose `InboxEngines` is an empty `ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>>`, build an `EngineGatedCommandRunner` over it with a recording `Action<string>` sink, act by awaiting `RunAsync("TrainSpam", () => { invoked = true; throw new NullReferenceException(); })`, and assert the call does not throw and `invoked` is `false`. Test 2, `RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException`: identical arrangement, with the action lambda reproducing the `TestSpam_Click` indexer shape by indexing the same empty `ConcurrentDictionary` (`engines.InboxEngines[SpamBayes.GroupName]`), acting through `RunAsync("TestSpam", ...)`, and asserting the call does not throw and the lambda was never entered. Both tests use MSTest + Moq + FluentAssertions, Arrange-Act-Assert, no temporary files, no `Thread.Sleep`, no `Task.Delay`, no wall-clock read, no `Form`, no `MessageBox`, and no live COM. Binary outcome: the file exists with exactly those two `[TestMethod]` members and the `<Compile Include>` entry is present in the csproj.
+- [x] [P1-T2] [expect-fail] Prove the red. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\regression-testing\fail-before-503.<TS>.md` exists with `Timestamp:`, `Command:`, a non-zero `EXIT_CODE:`, and an `Output Summary:` quoting the verbatim compiler diagnostics. The diagnostics must include CS0246 (or CS0103) naming `EngineGatedCommandRunner` and `EngineReadinessGate`, sourced from `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs`. Binary outcome: the artifact records a non-zero exit code whose cause is the absence of the guard types, not any other error.
+- [x] [P1-T3] Record the fail-before exception dossier explaining why a runtime (non-compile) red is structurally impossible for #503. Acceptance: `<FEATURE>\evidence\regression-testing\fail-before-exception.<TS>.md` exists with `Timestamp:`, a `WhyFailingRunImpossible:` section of one to three sentences stating that the defective production path lives entirely inside `[ExcludeFromCodeCoverage]`, COM-bound `RibbonViewer` handlers that require a live `Office.IRibbonControl` and route through `RibbonController.SB`/`Triage`, whose getters install a real `WindowsFormsSynchronizationContext` as a side effect and are prohibited by the spec test strategy, so the unit under test (`EngineGatedCommandRunner`) does not exist at the merge-base and the red is necessarily a compile-time red; a `SearchScope:` line naming `<FEATURE>\evidence\regression-testing\`; a `SearchPatterns:` line naming `fail-before-*.md`; a `SearchResult:` line naming the P1-T2 artifact path; and an alternative-proof section pointing at the P1-T2 diagnostics.
+
+---
+
+### Phase 2 — Host-Neutral Decision Types
+
+- [x] [P2-T1] Create `TaskMaster\Ribbon\EngineCommandCatalog.cs` in namespace `TaskMaster` as an `internal static class EngineCommandCatalog` implementing `TryGetEngineName` and `ControlIds` exactly per sections 5.1 and 5.2, backed by an ordinal-comparer map, extensible by a single entry for a future `Project`/`Context`/`Actionable` command, and add `<Compile Include="Ribbon\EngineCommandCatalog.cs" />` to `TaskMaster\TaskMaster.csproj`. The file must carry no `[ExcludeFromCodeCoverage]` attribute and zero `Microsoft.Office.*` and `Microsoft.Office.Interop.Outlook` using directives. Binary outcome: the file exists with exactly the eight catalog entries from section 5.1, the csproj entry is present, and `TryGetEngineName` returns `false` with a `null` out value for null, empty, and unknown ids.
+- [x] [P2-T2] Create `TaskMaster\Ribbon\EngineReadinessGate.cs` in namespace `TaskMaster` as an `internal sealed class EngineReadinessGate` implementing the section 5.3 readiness contract and the `IsEngineReady` / `TryGetEngine` signatures from section 5.2, with a constructor that throws `ArgumentNullException` on a null accessor, and add `<Compile Include="Ribbon\EngineReadinessGate.cs" />` to `TaskMaster\TaskMaster.csproj`. Use guard clauses and `?? throw new ArgumentNullException(...)` in the `HookReadinessCoordinator` style so the file is clean under `/p:Nullable=enable /p:TreatWarningsAsErrors=true`; do not use a scoped `#nullable enable annotations` pragma. The file must carry no `[ExcludeFromCodeCoverage]` attribute and zero `Microsoft.Office.*` using directives. Binary outcome: the file exists, the csproj entry is present, and readiness is recomputed on every call with no caching field.
+- [x] [P2-T3] Create `TaskMaster\Ribbon\EngineGatedCommandRunner.cs` in namespace `TaskMaster` as an `internal sealed class EngineGatedCommandRunner` implementing the section 5.4 runner contract and the `IsCommandEnabled` / `RunAsync` signatures from section 5.2, with a constructor throwing `ArgumentNullException` for either null argument, and add `<Compile Include="Ribbon\EngineGatedCommandRunner.cs" />` to `TaskMaster\TaskMaster.csproj`. No `catch (Exception)` may appear in the file. The file must carry no `[ExcludeFromCodeCoverage]` attribute and zero `Microsoft.Office.*` using directives. Binary outcome: the file exists, the csproj entry is present, and a blocked call emits exactly one sink notification and returns without invoking the action.
+- [x] [P2-T4] Create `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` in namespace `TaskMaster` as an `internal static class EngineCommandRefreshPlanner` implementing `InvalidateAll(Action<string> invalidateControl)` per section 5.2, invoking the delegate once per `EngineCommandCatalog.ControlIds` entry and throwing `ArgumentNullException` for a null delegate, and add `<Compile Include="Ribbon\EngineCommandRefreshPlanner.cs" />` to `TaskMaster\TaskMaster.csproj`. The file must carry no `[ExcludeFromCodeCoverage]` attribute and zero `Microsoft.Office.*` using directives. Binary outcome: the file exists, the csproj entry is present, and the invalidation set is derived from the catalog rather than a duplicated literal list.
+- [x] [P2-T5] Build the solution under the analyzer gate to confirm the four new types compile and are wired. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\other\phase2-build.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`.
+- [x] [P2-T6] Prove the green for the P1 regression tests. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.EngineGatedCommandRunnerTests'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\regression-testing\pass-after-503.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` naming both `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException` and `RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException` as Passed, with zero failed and zero skipped, and cross-referencing the P1-T2 fail-before artifact path.
+
+---
+
+### Phase 3 — Ribbon Shims, XML Wiring, and Startup Refresh
+
+- [x] [P3-T1] Change `TaskMaster\Ribbon\RibbonViewer.cs` line 33 from `public class RibbonViewer : Office.IRibbonExtensibility` to `public partial class RibbonViewer : Office.IRibbonExtensibility`. Binary outcome: exactly one line changes in the file, the `[System.Runtime.InteropServices.ComVisible(true)]` and `[ExcludeFromCodeCoverage]` attributes at lines 31-32 are untouched, and no second `ComVisible` attribute is introduced anywhere.
+- [x] [P3-T2] Create `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` in namespace `TaskMaster` as an additional part of the existing `public partial class RibbonController`, and add `<Compile Include="Ribbon\RibbonController.EngineCommands.cs" />` to `TaskMaster\TaskMaster.csproj`. The part lazily builds one `EngineReadinessGate(() => Globals?.Engines)` and one `EngineGatedCommandRunner(gate, NotifyEngineCommandNotReady)`, and exposes `internal bool IsEngineCommandEnabled(string controlId)`, `internal Task RunEngineCommandAsync(string controlId, Func<Task> action)`, and `internal void RefreshEngineCommands()` forwarding to `_viewer.InvalidateEngineCommands()`. The private `NotifyEngineCommandNotReady(string message)` sink implements section 5.6. Do not add a second `[ExcludeFromCodeCoverage]` attribute — the type-level attribute at `RibbonController.cs:36` already applies. Do not use `RibbonController.Engines` as the readiness accessor and do not route through `SB`/`Triage`/`TriageAsync`. Binary outcome: the file exists and the csproj entry is present. Do **not** build at this task: `RefreshEngineCommands()` forwards to `_viewer.InvalidateEngineCommands()`, which is not created until P3-T3, so a build here necessarily fails with CS1061. The first buildable point after this task is P3-T3, whose binary outcome already requires a successful build.
+- [x] [P3-T3] Create `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` in namespace `TaskMaster` as an additional part of `public partial class RibbonViewer` containing exactly two members at this point — `public bool EngineCommand_GetEnabled(Office.IRibbonControl control) => _controller?.IsEngineCommandEnabled(control?.Id) ?? false;` and `internal void InvalidateEngineCommands()` which returns without throwing when `_ribbon` is null, marshals explicitly through `UtilitiesCS.Threading.UiThread.Dispatcher` when the current thread is not the dispatcher thread rather than relying on the ambient synchronization context, and then calls `EngineCommandRefreshPlanner.InvalidateAll(_ribbon.InvalidateControl)` — and add `<Compile Include="Ribbon\RibbonViewer.EngineCommands.cs" />` to `TaskMaster\TaskMaster.csproj`. Do not add a second `ComVisible` or `ExcludeFromCodeCoverage` attribute. Binary outcome: the file exists with exactly those two members, the csproj entry is present, and the solution builds.
+- [x] [P3-T4] Relocate the `#region Spam Manager` block (`TaskMaster\Ribbon\RibbonViewer.cs` lines 250-296 at merge-base, inclusive of the nested `#region Spam Config`) and the `#region Triage` block (lines 298-347 at merge-base, inclusive of the nested `#region Triage Config`) verbatim into `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs`. This is a pure move with no behavior change and no member rewrite. Binary outcome: `RibbonViewer.cs` no longer contains either region; `RibbonViewer.EngineCommands.cs` contains both regions; the set of member names in the moved text is identical name-for-name to the merge-base set (`ClearSpam_Click`, `TrainSpam_Click`, `TrainHam_Click`, `TestSpam_Click`, `TestSpamVerbose_Click`, `SpamMetrics_Click`, `SpamInvestigateErrors_Click`, `SpamBayesEnabled_Click`, `SpamBayesEnabled_GetPressed`, `SpamSaveNetwork_Click`, `SpamSaveLocal_Click`, `GetSaveLocation_Click`, `SpamFolderSettings_Click`, `TriageSelection_Click`, `TriageSetA_Click`, `TriageSetB_Click`, `TriageSetC_Click`, `ClearTriage_Click`, `ResetTriage_Click`, `SetPrecision_Click`, `FilterViewer_Click`, `TriageEnabled_Click`, `TriageEnabled_GetPressed`, `TriageSaveNetwork_Click`, `TriageSaveLocal_Click`, `TriageGetSaveLocation_Click`); the three commented-out `TriageSet*_Click` lines at merge-base 312-314 move with the block; and the solution builds.
+- [x] [P3-T5] Rewrite exactly the eight handlers named in section 5.1 inside `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` so each routes through `Controller.RunEngineCommandAsync(<control id>, () => <the merge-base expression, unchanged>)`, for example `public async void TrainSpam_Click(Office.IRibbonControl control) => await Controller.RunEngineCommandAsync("TrainSpam", () => Controller.SB.TrainAsync(Controller.OlSelection, true));`. `FilterViewer_Click` uses control id `FilterTriageGroup`. Binary outcome: exactly those eight handlers change; every other member relocated in P3-T4 is byte-identical to its merge-base text; every engine dereference (`Controller.SB`, `Controller.Triage`, `Controller.Engines.InboxEngines[...]`) appears only inside a lambda body and never in an argument evaluated before `RunEngineCommandAsync` is entered; no `catch (Exception)` is added; and the solution builds.
+- [x] [P3-T6] Add `getEnabled="EngineCommand_GetEnabled"` to exactly the eight `<button>` elements in `TaskMaster\Ribbon\RibbonExplorer.xml` with ids `TrainSpam` (lines 99-104), `TrainHam` (105-110), `TestSpam` (150-155), `TriageSetA` (445), `TriageSetB` (446), `TriageSetC` (447), `FilterTriageGroup` (449-454), and `ClearTriage` (455-460), hand-edited to match the surrounding one-attribute-per-line style. Binary outcome: exactly eight occurrences of `getEnabled="EngineCommand_GetEnabled"` exist in the file; no `menu`, `group`, or `tab` element is modified; in particular `menu id="OtherSpamActions"` and `menu id="OtherTriageActions"` are unmodified; the document remains well-formed XML in the `http://schemas.microsoft.com/office/2009/07/customui` namespace. CSharpier does not format XML, so no formatter pass applies to this file.
+- [x] [P3-T7] Add exactly one refresh statement plus a why-comment to `TaskMaster\ThisAddIn.cs` immediately after `await _globals.LoadAsync(false);` at line 76, invoking `_ribbonController.RefreshEngineCommands();`. The comment must state why the refresh is load-bearing: Office caches each `getEnabled` response per control until the add-in invalidates it, so without this call the eight engine-backed buttons remain disabled for the whole session even after `InitAsync()` succeeds. Binary outcome: exactly one `RefreshEngineCommands()` call site exists in the entire repository outside `RibbonController.EngineCommands.cs`; it is inside the `useUiThread: true` idle-queue entry added at lines 71-81; and the solution builds.
+- [x] [P3-T8] Build the solution under the analyzer gate after the shim, XML, and startup changes. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\other\phase3-build.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`.
+
+---
+
+### Phase 4 — Remaining Unit Tests and XML Regression Suite
+
+- [x] [P4-T1] Extend `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` with the remaining runner cases, keeping the two P1 regression tests unchanged: `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName`; `RunAsync_WhenEngineReady_InvokesActionExactlyOnce`; `RunAsync_WhenEngineReady_AwaitsActionToCompletion` driven by a `TaskCompletionSource` completed synchronously by the test; `RunAsync_WhenActionThrows_PropagatesException`; `RunAsync_WithUnknownControlId_DoesNotInvokeAction`; `RunAsync_WithNullAction_ThrowsArgumentNullException`; `IsCommandEnabled_WhenEngineNotReady_ReturnsFalse`; `IsCommandEnabled_WhenEngineReady_ReturnsTrue`; `IsCommandEnabled_WithUnknownControlId_ReturnsFalse`; and `Constructor_WithNullGate_ThrowsArgumentNullException` plus `Constructor_WithNullNotificationSink_ThrowsArgumentNullException`. Binary outcome: the file contains all thirteen `[TestMethod]` members, uses MSTest + Moq + FluentAssertions with Arrange-Act-Assert, contains no temporary file, `Thread.Sleep`, `Task.Delay`, wall-clock read, `Form`, `MessageBox`, message pump, or live COM, and remains at or under 500 lines.
+- [x] [P4-T2] Create `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs` in namespace `TaskMaster.Test.Ribbon` and add `<Compile Include="Ribbon\EngineReadinessGateTests.cs" />` to `TaskMaster.Test\TaskMaster.Test.csproj`. Required `[TestMethod]` members: `IsEngineReady_WhenAccessorReturnsNull_ReturnsFalse`; `IsEngineReady_WhenInboxEnginesIsNull_ReturnsFalse`; `IsEngineReady_WhenInboxEnginesIsEmpty_ReturnsFalse`; `IsEngineReady_WhenKeyPresentWithNonNullEngine_ReturnsTrue`; `IsEngineReady_WhenKeyPresentWithNullValue_ReturnsFalse`; `IsEngineReady_WithNullOrWhitespaceName_ReturnsFalse`; `IsEngineReady_IsOrdinalCaseSensitive` asserting `"spam"` is not `"Spam"`; `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` mutating the same `ConcurrentDictionary` instance between two calls with no `Thread.Sleep` or `Task.Delay`; `TryGetEngine_WhenReady_OutputsSameInstance`; `TryGetEngine_WhenNotReady_OutputsNull`; and `Constructor_WithNullAccessor_ThrowsArgumentNullException`. Binary outcome: the file exists with all eleven members, the csproj entry is present, and no test reaches the gate through `RibbonController.SB`/`Triage`/`TriageAsync`.
+- [x] [P4-T3] Create `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs` in namespace `TaskMaster.Test.Ribbon` and add `<Compile Include="Ribbon\EngineCommandCatalogTests.cs" />` to `TaskMaster.Test\TaskMaster.Test.csproj`. Required `[TestMethod]` members: a `[DataTestMethod]` with eight `[DataRow]` entries covering every control id to engine key pair from section 5.1; `TryGetEngineName_ForUnknownControlId_ReturnsFalse`; `TryGetEngineName_WithNullControlId_ReturnsFalse`; `TryGetEngineName_WithEmptyControlId_ReturnsFalse`; `ControlIds_ContainsExactlyTheEightEngineBackedControlIds` asserted as set equality; and `ControlIds_ContainsNoDuplicates`. Binary outcome: the file exists with all six members, the csproj entry is present, and the eight data rows match section 5.1 exactly.
+- [x] [P4-T4] Create `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs` in namespace `TaskMaster.Test.Ribbon` and add `<Compile Include="Ribbon\EngineCommandRefreshPlannerTests.cs" />` to `TaskMaster.Test\TaskMaster.Test.csproj`. Required `[TestMethod]` members: `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` asserting the captured id collection as SET equality against `EngineCommandCatalog.ControlIds` and never as an ordered sequence, because Office documents callback ordering as unspecified; and `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException`. Binary outcome: the file exists with both members, the csproj entry is present, and no order-dependent assertion appears.
+- [x] [P4-T5] Extend `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` with four new `[TestMethod]` members using the existing namespace-aware `LoadRibbonDocument()` embedded-resource helper: `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` asserting each `EngineCommandCatalog.ControlIds` entry exists in the XML and carries `getEnabled="EngineCommand_GetEnabled"`; `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` asserting no other element carries that attribute value; `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` asserting each catalog id resolves to a `button` element and never to a `group` or `tab`; and `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` asserting by reflection that `typeof(RibbonViewer)` exposes a `public` instance method named `EngineCommand_GetEnabled` whose return type is `bool` and whose single parameter's `ParameterType.FullName` equals the literal string `"Microsoft.Office.Core.IRibbonControl"`. The assertion **must** compare the parameter type by `FullName` string and must **not** use `typeof(Microsoft.Office.Core.IRibbonControl)`: `TaskMaster.Test.csproj` carries no `<Reference Include="Office, Version=15.0.0.0 ...">` (only `Microsoft.Office.Interop.Outlook`), and a legacy non-SDK `ProjectReference` does not flow that reference to the compiler, so a `typeof` form would fail to compile and would force a `<Reference>` addition that section 4.3 does not permit. `office.dll` is present in `TaskMaster.Test\bin\Debug\` and in the GAC, so runtime reflection over the parameter type resolves at test time. Binary outcome: the file contains the four new members in addition to its merge-base members, uses no filesystem access and no live Outlook, and remains at or under 500 lines.
+- [x] [P4-T6] Run the scoped Ribbon test set. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\regression-testing\phase4-scoped-tests.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording total/passed/failed/skipped with zero failed and zero skipped. Rebuild first if the last build predates any Phase 4 edit.
+- [x] [P4-T7] Commit every source and test change made in Phases 1 through 4 so the Phase 5 and Phase 6 `<MERGE_BASE>..HEAD` diff gates observe the real change set. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'fix(#503): engine-readiness guard for engine-backed ribbon commands'; git status --porcelain; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\other\phase4-commit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`. Binary outcome: `git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD` now lists every path in the section 4 scope lock that was created or modified, and `git status --porcelain` is empty.
+
+---
+
+### Phase 5 — Structural Verification
+
+- [x] [P5-T1] Verify the AC15 zero-line diff. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD"`. Acceptance: `<FEATURE>\evidence\qa-gates\zero-line-diff.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` containing the full `--numstat` output plus an explicit statement that neither `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, nor `TaskMaster/AppGlobals/ApplicationGlobals.cs` appears in the output, and that every path that appears is either a member of the section 4 scope lock **or** lies under `docs/features/` or `.claude/agent-memory/` (documentation and evidence, which are expected diff entries and are not source-scope violations). Binary outcome: the three protected paths are absent, and no `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears.
+- [x] [P5-T2] Verify no `[ExcludeFromCodeCoverage]` attribute exists in the four new decision files (AC26). Acceptance: `<FEATURE>\evidence\qa-gates\no-coverage-exclusion.<TS>.md` exists with `Timestamp:`, `Command:` recording the grep used over `TaskMaster\Ribbon\EngineCommandCatalog.cs`, `TaskMaster\Ribbon\EngineReadinessGate.cs`, `TaskMaster\Ribbon\EngineGatedCommandRunner.cs`, and `TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs`, `EXIT_CODE:`, and an `Output Summary:` recording zero occurrences across all four files.
+- [x] [P5-T3] Verify the architecture-boundary surface (AC27). Acceptance: `<FEATURE>\evidence\qa-gates\office-surface-audit.<TS>.md` exists with `Timestamp:`, `Command:` recording each grep used, `EXIT_CODE:`, and an `Output Summary:` establishing three facts: the four new decision files contain zero `Microsoft.Office.` and zero `Microsoft.Office.Interop.Outlook` using directives and zero `Office.` type references; `public bool EngineCommand_GetEnabled(Office.IRibbonControl control)` in `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` is the only new `Microsoft.Office.*`-typed member introduced by the branch diff; and the branch diff adds zero new `[ComVisible(true)]` attributes anywhere.
+- [x] [P5-T4] Verify no new broad exception handler was introduced (AC14 second clause). Acceptance: `<FEATURE>\evidence\qa-gates\no-new-broad-catch.<TS>.md` exists with `Timestamp:`, `Command:` recording the grep for `catch (Exception` and `catch(Exception` over every added or modified `.cs` path in the section 4 scope lock, `EXIT_CODE:`, and an `Output Summary:` recording zero added occurrences relative to `<MERGE_BASE>`.
+- [x] [P5-T5] Verify test determinism constraints (AC28). Acceptance: `<FEATURE>\evidence\qa-gates\test-determinism-audit.<TS>.md` exists with `Timestamp:`, `Command:` recording the greps used over the five test files in section 4.3, `EXIT_CODE:`, and an `Output Summary:` recording zero occurrences of each of: `Path.GetTempPath`, `Path.GetTempFileName`, `Thread.Sleep`, `Task.Delay`, `DateTime.Now`, `DateTime.UtcNow`, `DateTimeOffset.Now`, `new Form`, `MessageBox`, `Application.Run`, `Application.DoEvents`, and `Microsoft.Office.Interop.Outlook`.
+- [x] [P5-T6] Verify the AC10 lambda-deferral property. Acceptance: `<FEATURE>\evidence\qa-gates\lambda-deferral-audit.<TS>.md` exists with `Timestamp:`, `Command:` recording the inspection performed, `EXIT_CODE:`, and an `Output Summary:` quoting each of the eight rewritten handler bodies from `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` and stating for each that its engine dereference appears only inside the `Func<Task>` lambda argument, so no engine is dereferenced when the gate is closed.
+- [x] [P5-T7] Verify the AC16 ready-path preservation. Acceptance: `<FEATURE>\evidence\qa-gates\ready-path-preservation.<TS>.md` exists with `Timestamp:`, `Command:` recording the diff inspection performed, `EXIT_CODE:`, and an `Output Summary:` placing each of the eight merge-base handler expressions beside its post-change lambda body and stating that the invoked expression text is unchanged in each case (for example `Controller.SB.TrainAsync(Controller.OlSelection, true)`).
+- [x] [P5-T8] Verify the AC18 refresh wiring. Acceptance: `<FEATURE>\evidence\qa-gates\refresh-wiring-audit.<TS>.md` exists with `Timestamp:`, `Command:` recording the inspection performed, `EXIT_CODE:`, and an `Output Summary:` quoting `RibbonViewer.InvalidateEngineCommands()` and establishing three facts: it returns without throwing when `_ribbon` is null; it marshals explicitly through `UtilitiesCS.Threading.UiThread.Dispatcher` rather than relying on the ambient synchronization context; and `TaskMaster\ThisAddIn.cs` invokes the refresh exactly once, immediately after `await _globals.LoadAsync(false);`.
+- [x] [P5-T9] Verify all ten `<Compile Include>` entries are present and correct. Acceptance: `<FEATURE>\evidence\qa-gates\csproj-registration-audit.<TS>.md` exists with `Timestamp:`, `Command:` recording the grep over both csproj files, `EXIT_CODE:`, and an `Output Summary:` listing the six entries added to `TaskMaster\TaskMaster.csproj` and the four added to `TaskMaster.Test\TaskMaster.Test.csproj` exactly as specified in section 4.6, and confirming that every `Compile Include` path in both projects resolves to an existing file on disk.
+
+---
+
+### Phase 6 — Final QC Loop
+
+Loop semantics: the order is format, then the post-format size audit, then lint, then type-check, then test. If any task in this phase fails, or if any task changes a file on disk, fix the cause and restart the phase from P6-T1. No task in this phase may be recorded as `EXIT_CODE: SKIPPED`; every task must execute its stated command and record the real result. The phase is complete only when P6-T1 through P6-T10 all succeed within a single uninterrupted pass.
+
+- [x] [P6-T1] Format the scope-locked C# files. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' format TaskMaster\Ribbon\EngineCommandCatalog.cs TaskMaster\Ribbon\EngineReadinessGate.cs TaskMaster\Ribbon\EngineGatedCommandRunner.cs TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs TaskMaster\Ribbon\RibbonController.EngineCommands.cs TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs TaskMaster\Ribbon\RibbonViewer.cs TaskMaster\ThisAddIn.cs TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\csharpier-format.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:` listing which files CSharpier rewrote. `csharpier pipe-files` is prohibited. `TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` must not appear in the argument list.
+- [x] [P6-T2] Verify formatting repo-wide, read-only. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\csharpier-check.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:`. Binary outcome: either `EXIT_CODE: 0`, or a non-zero exit whose reported unformatted-file set is exactly the merge-base set recorded in P0-T6 and contains none of the thirteen scope-locked `.cs` paths from section 4.5. If any scope-locked file is reported unformatted, restart the phase at P6-T1.
+- [x] [P6-T3] Run the authoritative post-format 500-line audit over every file in the branch diff (AC25). Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --name-only 003c5715055d7d1933db68a742531332756e30b2..HEAD | ForEach-Object { if (Test-Path $_) { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines } }"`. Acceptance: `<FEATURE>\evidence\qa-gates\file-size-audit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` listing every changed path with its post-format line count, together with an explicit statement that every path that appears is either a member of the section 4 scope lock **or** lies under `docs/features/` or `.claude/agent-memory/` (documentation and evidence, which are expected diff entries and are not source-scope violations). Markdown documentation and evidence files in the diff (including every `.md` path under `docs/features/` and `.claude/agent-memory/`) are EXEMPT from the 500-line cap per the file-size exceptions in `.claude/rules/general-code-change.md`, which exempt Markdown documentation files; record their line counts for the audit trail but never treat a Markdown overage as a violation. Binary outcome: every `.cs` path is at or under 500 lines, no `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears, `TaskMaster\Ribbon\RibbonViewer.cs` is recorded below its 487-line merge-base count, and `TaskMaster\Ribbon\RibbonExplorer.xml` is recorded as an accepted pre-existing exception (519 lines at merge-base, declarative embedded UI resource, overage predates #503) rather than a violation. Any `.cs` file over 500 lines restarts the phase at P6-T1 after the offending file is split.
+- [x] [P6-T4] Run the analyzer gate. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\msbuild-analyzers.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording zero errors and no new analyzer diagnostics relative to the P0-T7 baseline.
+- [x] [P6-T5] Run the nullable/type-check gate. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\msbuild-nullable.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, `Output Summary:`.
+- [x] [P6-T6] Run the full test suite with coverage. Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\qa-gates\coverage-final.cobertura.xml` run from `<REPO>`. Acceptance: both `<FEATURE>\evidence\qa-gates\coverage-final.cobertura.xml` and `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md` exist. The `.md` artifact carries `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` containing total/passed/failed/skipped counts, the numeric root `<coverage>` attributes `line-rate`, `branch-rate`, `lines-covered`, `lines-valid`, and an explicit reconciliation of any failure against the P0-T10 pre-existing set. Binary outcome: zero skipped tests, and either zero failed tests or a failure set that is a subset of the P0-T10 pre-existing set. Any failure outside that set is a regression: fix it and restart the phase at P6-T1.
+- [x] [P6-T7] Extract per-type line coverage for the four new types from `<FEATURE>\evidence\qa-gates\coverage-final.cobertura.xml` (AC23). Acceptance: `<FEATURE>\evidence\qa-gates\new-type-coverage.<TS>.md` exists with `Timestamp:`, `Command:` recording the XML query used, `EXIT_CODE:`, and an `Output Summary:` recording the numeric `line-rate` for each of `TaskMaster.EngineCommandCatalog`, `TaskMaster.EngineReadinessGate`, `TaskMaster.EngineGatedCommandRunner`, and `TaskMaster.EngineCommandRefreshPlanner`. Binary outcome: each of the four values is at or above 0.90. If any value is below 0.90, add the missing test cases and restart the phase at P6-T1.
+- [x] [P6-T8] Produce the coverage comparison (AC24). Acceptance: `<FEATURE>\evidence\qa-gates\coverage-comparison.<TS>.md` exists with `Timestamp:` and a table comparing the P0-T9 baseline against the P6-T6 final run for `line-rate`, `branch-rate`, `lines-covered`, and `lines-valid`; the per-type new-code figures from P6-T7; and an explicit changed-line no-regression statement covering every `.cs` path in the section 4 scope lock. The artifact must state that the raw repo-wide figure spans vendored/third-party projects (SVGControl, SDILReader, VBFunctions) and is therefore NOT the CLAUDE.md section UT2 testable denominator, that the merge-base repo-wide figure is recorded and reported as pre-existing debt and non-blocking for this bug fix per the #424 precedent, and that the blocking gates for #503 are the changed-line no-regression requirement and the at-or-above 0.90 new-type floor from P6-T7. The artifact must also record the documented threshold conflict (CLAUDE.md 80 percent repo-wide / 90 percent new code versus `.claude/rules/general-unit-test.md` 85 percent line / 75 percent branch) as a known, unresolved policy conflict rather than silently selecting one number.
+- [x] [P6-T9] Record the single uninterrupted clean toolchain pass (AC22). Acceptance: `<FEATURE>\evidence\qa-gates\toolchain-clean-pass.<TS>.md` exists with `Timestamp:` and, in order, the artifact path plus `EXIT_CODE:` for P6-T1, P6-T2, P6-T4, P6-T5, and P6-T6, together with an explicit statement that all five ran in one pass with no intervening file change and no restart. For the purpose of the single-uninterrupted-pass criterion, "an intervening file change" means a change to a `.cs`, `.csproj`, `.xml`, or `.sln` file only; writing this phase's own evidence artifacts under `<FEATURE>\evidence\qa-gates\` does not count as an intervening file change and does not break the pass. Binary outcome: the recorded sequence contains no restart.
+- [x] [P6-T10] Re-verify the AC15 zero-line diff after the final format pass. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD"`. Acceptance: `<FEATURE>\evidence\qa-gates\zero-line-diff-postformat.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` confirming that `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, and `TaskMaster/AppGlobals/ApplicationGlobals.cs` are still absent from the diff, and that every path that appears is either a member of the section 4 scope lock **or** lies under `docs/features/` or `.claude/agent-memory/` (documentation and evidence, which are expected diff entries and are not source-scope violations). Binary outcome: the three protected paths are absent, and no `.cs`, `.csproj`, `.xml`, or `.sln` path outside the section 4 scope lock appears.
+
+---
+
+### Phase 7 — Acceptance Criteria, Manual Verification, and Documentation
+
+AC source file for every check-off task in this phase: `<FEATURE>\spec.md`. Each task flips exactly one `- [ ]` to `- [x]` and changes no criterion text.
+
+- [x] [P7-T1] Author the manual-verification checklist covering AC19, AC20, and AC21. Acceptance: `<FEATURE>\evidence\manual-verification\ac19-ac21-checklist.<TS>.md` exists with `Timestamp:`, a `Status: PENDING MAINTAINER EXECUTION` line, and one numbered, individually-signable step per spec section `## Test Strategy` / `### Manual validation` item: (1) reload the add-in and, during initialization, click each of the eight engine-backed commands, confirming no `NullReferenceException` and no `KeyNotFoundException` in the log and that a "still loading" indication appears; (2) confirm Office visually greys the eight buttons during initialization; (3) after initialization completes, confirm the eight buttons become enabled without an add-in restart; (4) confirm each of the eight commands behaves exactly as before once enabled. Each step names the AC it satisfies (step 1 to AC19, step 4 to AC20, steps 2 and 3 to AC21) and carries an outcome field left blank for the maintainer.
+- [x] [P7-T2] Verify AC19, AC20, and AC21 remain unchecked in `<FEATURE>\spec.md`. Acceptance: `<FEATURE>\evidence\manual-verification\manual-only-unchecked.<TS>.md` exists with `Timestamp:` and quotes the three criterion lines verbatim from `spec.md`, each still beginning `- [ ] **AC19`, `- [ ] **AC20`, and `- [ ] **AC21`. Binary outcome: all three remain `- [ ]`. Checking any of them off from unit-test or source-inspection evidence is a policy violation.
+- [x] [P7-T3] Check off AC1 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\no-coverage-exclusion.<TS>.md`, `<FEATURE>\evidence\qa-gates\office-surface-audit.<TS>.md`, and `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T4] Check off AC2 in `<FEATURE>\spec.md`. Evidence: the `EngineReadinessGateTests` results in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T5] Check off AC3 in `<FEATURE>\spec.md`. Evidence: `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T6] Check off AC4 in `<FEATURE>\spec.md`. Evidence: `Constructor_WithNullAccessor_ThrowsArgumentNullException` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T7] Check off AC5 in `<FEATURE>\spec.md`. Evidence: `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T8] Check off AC6 in `<FEATURE>\spec.md`. Evidence: `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T9] Check off AC7 in `<FEATURE>\spec.md`. Evidence: `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T10] Check off AC8 in `<FEATURE>\spec.md`. Evidence: `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T11] Check off AC9 in `<FEATURE>\spec.md`. Evidence: the `EngineCommandCatalogTests` results in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T12] Check off AC10 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\lambda-deferral-audit.<TS>.md` plus `RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T13] Check off AC11 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\regression-testing\fail-before-503.<TS>.md` and `<FEATURE>\evidence\regression-testing\pass-after-503.<TS>.md`, covering both `NullReferenceException` and `KeyNotFoundException`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T14] Check off AC12 in `<FEATURE>\spec.md`. Evidence: `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`, plus `<FEATURE>\evidence\qa-gates\test-determinism-audit.<TS>.md` confirming no `Form` or `MessageBox` in tests. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T15] Check off AC13 in `<FEATURE>\spec.md`. Evidence: `RunAsync_WithNullAction_ThrowsArgumentNullException` and `RunAsync_WithUnknownControlId_DoesNotInvokeAction` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T16] Check off AC14 in `<FEATURE>\spec.md`. Evidence: `RunAsync_WhenActionThrows_PropagatesException` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md` and `<FEATURE>\evidence\qa-gates\no-new-broad-catch.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T17] Check off AC15 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\zero-line-diff-postformat.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T18] Check off AC16 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\ready-path-preservation.<TS>.md` plus `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` and `RunAsync_WhenEngineReady_AwaitsActionToCompletion`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T19] Check off AC17 in `<FEATURE>\spec.md`. Evidence: `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` and `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException` in `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T20] Check off AC18 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\refresh-wiring-audit.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T21] Check off AC22 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\toolchain-clean-pass.<TS>.md`. AC22's literal "zero failed" clause is read against the section 3 rule 7 pass rule: if the P6-T6 failure set is empty, check off AC22 directly. If the P6-T6 failure set is non-empty and is a subset of the P0-T10 pre-existing set, check off AC22 **and** append a one-line reconciliation note immediately beneath the AC22 line in `spec.md` naming each pre-existing failure, its tracking issue (#508), and the P6-T6 artifact path, so the check-off is not silently overstated. If any failure lies outside the P0-T10 set, AC22 must be left `- [ ]` and the Phase 6 loop restarted at P6-T1. Binary outcome: exactly one checkbox flips, plus at most one appended reconciliation line.
+- [x] [P7-T22] Check off AC23 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\new-type-coverage.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T23] Check off AC24 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\baseline\coverage-baseline.cobertura.xml`, `<FEATURE>\evidence\qa-gates\coverage-final.cobertura.xml`, and `<FEATURE>\evidence\qa-gates\coverage-comparison.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T24] Check off AC25 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\file-size-audit.<TS>.md` (the post-format audit from P6-T3, not the advisory P0-T11 counts). Binary outcome: exactly one checkbox flips.
+- [x] [P7-T25] Check off AC26 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\no-coverage-exclusion.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T26] Check off AC27 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\office-surface-audit.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T27] Check off AC28 in `<FEATURE>\spec.md`. Evidence: `<FEATURE>\evidence\qa-gates\test-determinism-audit.<TS>.md` and the `BannedSymbols.txt` analyzer result recorded in `<FEATURE>\evidence\qa-gates\msbuild-analyzers.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T28] Check off AC29 in `<FEATURE>\spec.md` and record the promotion receipts. Acceptance: `<FEATURE>\evidence\issue-updates\out-of-scope-promotions.<TS>.md` exists with `Timestamp:` and the section 6 table mapping each research section 9 defect to issue **#504**, **#505**, **#506**, **#507**, plus **#508** for the baseline flake, and states explicitly that these were promoted upstream of this plan and that no promotion lifecycle call and no fix for any of them was made inside #503. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T29] Update the delivery documentation. Acceptance: `<FEATURE>\spec.md` `Status:` reads `Delivered`; this plan's `Status:` reads `Executed`; `<FEATURE>\issue.md` records the delivered outcome; and a `## Delivery Notes and Deviations` section is appended to `<FEATURE>\spec.md` recording every deviation from the design, at minimum the section 5.6 notification-presentation decision (the repository has no non-modal notification surface, so the sink uses the established `logger.Warn` plus `MessageBox.Show` mechanism; introducing a new non-modal surface was out of scope for a bug fix) and the section 3 rule 5 CSharpier scope restriction and its rationale. If no other deviation occurred, state that explicitly.
+- [x] [P7-T30] Check off AC30 in `<FEATURE>\spec.md`. Evidence: the P7-T29 documentation updates and `<FEATURE>\evidence\manual-verification\ac19-ac21-checklist.<TS>.md`. Binary outcome: exactly one checkbox flips.
+- [x] [P7-T31] Produce the acceptance-criteria status summary required by `.claude/skills/acceptance-criteria-tracking/SKILL.md`. Acceptance: `<FEATURE>\evidence\issue-updates\ac-status-summary.<TS>.md` exists with `Timestamp:`, `Source: <FEATURE>\spec.md`, `Total AC items: 30`, `Checked off (delivered): 27`, `Remaining (unchecked): 3`, and `Items remaining:` listing AC19, AC20, and AC21 with the reason MANUAL-ONLY, pending maintainer execution of the P7-T1 checklist. Binary outcome: the counts in the artifact match the actual checkbox state of `spec.md`.
+- [x] [P7-T32] Commit the Phase 5 through Phase 7 verification evidence and acceptance-criteria check-offs, then verify the worktree is clean and every evidence artifact is committed. The commit is an explicit part of this task, not an assumed precondition. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'docs(#503): Phase 5-7 verification evidence and acceptance-criteria check-offs'; git status --porcelain"`. Acceptance: `<FEATURE>\evidence\other\final-worktree-state.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording empty porcelain output. Binary outcome: `git status --porcelain` returns no lines, and every artifact path named anywhere in this plan exists on disk and is tracked.
+
+---
+
+## 8. Traceability
+
+| Requirement / AC | Delivered by | Verified by |
+|---|---|---|
+| R1, AC1-AC4 | P2-T2 | P4-T2, P6-T6, P7-T3 to P7-T6 |
+| R2, AC5-AC9 | P2-T1, P3-T3, P3-T6 | P4-T3, P4-T5, P6-T6, P7-T7 to P7-T11 |
+| R3, AC10-AC14 | P1-T1, P2-T3, P3-T5 | P1-T2, P2-T6, P4-T1, P5-T4, P5-T6, P7-T12 to P7-T16 |
+| R4, AC15 | no change made to the protected files | P5-T1, P6-T10, P7-T17 |
+| R6, AC16 | P3-T4, P3-T5 | P5-T7, P7-T18 |
+| R5c, AC17-AC18 | P2-T4, P3-T3, P3-T7 | P4-T4, P5-T8, P7-T19, P7-T20 |
+| R5b, AC19-AC21 | manual, maintainer-executed | P7-T1, P7-T2 (left unchecked by design) |
+| R5a, AC22-AC24 | Phase 6 | P6-T7, P6-T8, P6-T9, P7-T21 to P7-T23 |
+| AC25 | P3-T4 | P6-T3, P7-T24 |
+| AC26-AC28 | Phase 2, Phase 4 | P5-T2, P5-T3, P5-T5, P7-T25 to P7-T27 |
+| AC29 | promoted upstream as #504, #505, #506, #507 (and #508) | P7-T28 |
+| AC30 | P7-T29 | P7-T30, P7-T31 |
+
+---
+
+## 9. Recorded decisions
+
+- **D1 — Option (c) selected.** Readiness is computed from the existing `IAppItemEngines.InboxEngines` member in four new host-neutral types. Options (a) `IsInitialized`/`InitTask` and (b) `IsEngineReady` on `IAppItemEngines` are rejected: (a) reports ready for engines that `InitAsync` filtered out via `config.Value.Engine` and requires editing the R4-fenced method; (b) is semantically correct but .NET Framework 4.8.1 has no default interface member support, so its body could only live on the `[ExcludeFromCodeCoverage]` `AppItemEngines`, producing zero covered lines. This plan does not re-litigate that choice.
+- **D2 — The `RibbonViewer.cs` partial split is required, not cosmetic.** The file is 487 of 500 lines at merge-base; the new callbacks cannot be added in place. P3-T4 is a pure move that nets the file to roughly 389 lines.
+- **D3 — Notification presentation.** Recorded in section 5.6. The spec's parenthetical "non-modal indication" is aspirational; the repository has no non-modal notification surface, and introducing one is scope creep for a bug fix. The binding criterion AC12 requires only that exactly one notification is emitted through the injected sink with the control id and engine key, which is fully unit-tested. The deviation is recorded in P7-T29.
+- **D4 — CSharpier is scoped, not repo-wide, for the mutating pass.** Section 3 rule 5. The merge-base CSharpier state has now been MEASURED rather than assumed: `csharpier check .` at `<MERGE_BASE>` returns `EXIT 0` over 1488 files, so the repository is already formatter-clean at the merge-base and the merge-base unformatted set is empty. On that measured state the scope-locked mutating pass and a repo-wide mutating pass are equivalent in effect, because there is no unformatted merge-base file for a repo-wide pass to rewrite. The mechanism is nonetheless retained unchanged (scope-locked `csharpier format` on the section 4.5 path list, plus the read-only repo-wide `csharpier check .` gate at P6-T2) for two reasons: it is fail-safe if the measured state drifts before or during execution, and it makes the AC15 zero-line-diff guarantee structural rather than dependent on a measurement taken at plan time. P0-T6 remains a real measurement task that must execute and record its own result.
+- **D5 — The red is a compile-time red.** The unit under test does not exist at the merge-base, and the defective production path is unreachable from a deterministic unit test (COM-bound `[ExcludeFromCodeCoverage]` handlers, plus the `SB`/`Triage` synchronization-context side effect). P1-T3 records the fail-before exception dossier that makes this auditable.
+- **D6 — Coverage gating.** The blocking gates are the at-or-above 0.90 line rate for each of the four new types (P6-T7) and changed-line no-regression (P6-T8). The raw repo-wide figure (0.7043 line / 0.5850 branch at merge-base) spans vendored/third-party projects, is not the CLAUDE.md section UT2 testable denominator, and is recorded and reported as pre-existing debt rather than used as a blocking floor on a bug fix, per the #424 precedent. The documented CLAUDE.md versus `.claude/rules/general-unit-test.md` threshold conflict is recorded, not silently resolved.
+- **D7 — Issue #508 is out of scope.** The pre-existing order-dependent flake `YieldAsync_WithoutDispatcher_RemainsStrict` must not be fixed inside #503. Section 3 rule 7 defines exactly how a final-QC run is judged in its presence.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md
new file mode 100644
index 000000000..3413d68fc
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T14-15.md
@@ -0,0 +1,225 @@
+# Policy Compliance Audit — ribbon-engine-readiness-guard (Issue #503)
+
+- Feature folder: `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`
+- Base branch: `main`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2` (recomputed this session with `git merge-base HEAD origin/main`; matches the caller-supplied value)
+- Head: `bug/ribbon-engine-readiness-guard-503` @ `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c`
+- Work mode: `full-bug` (marker `- Work Mode: full-bug` in `issue.md:12`); acceptance-criteria source is `spec.md` only
+- Audit scope: the full branch diff against the resolved base branch (86 changed paths)
+- Reviewed: 2026-08-08T14-15
+
+## Executive Summary
+
+The change closes an initialization race in which eight engine-backed Explorer-ribbon commands could be clicked before `AppItemEngines.InitAsync()` had populated `Globals.Engines.InboxEngines`, producing an unhandled `NullReferenceException` or `KeyNotFoundException` out of an `async void` handler. The fix introduces four new host-neutral `internal` decision types under `TaskMaster\Ribbon\`, none carrying `[ExcludeFromCodeCoverage]`, plus two thin partials inside pre-existing coverage-exempt COM shims, a `getEnabled` attribute on the eight affected buttons, and one post-initialization invalidation call.
+
+All four toolchain stages were re-run or re-verified independently this session and pass. Formatting is clean repo-wide (exit 0 over 1498 files). The analyzer build and the type-check build both return exit 0. The 69 tests in the `TaskMaster.Test.Ribbon` namespace, including all 45 tests added by this change, pass under the repository's sanctioned test invocation. Repository C# line coverage is 85.85% and branch coverage is 79.25%, both above the uniform floors and both marginally improved against the captured merge-base baseline.
+
+Nine findings are recorded, none of them blocking. Three are Medium: a vacuously-passing assertion in the ribbon-XML regression test that names AC5, the pre-existing incremental-build vacuity of the mandated type-check gate, and a 20-line increase to a UI resource file that was already above the repository line limit. The remaining six are Low or informational. The three MANUAL-ONLY acceptance criteria (AC19, AC20, AC21) correctly remain unchecked and require maintainer execution against a live Outlook profile before merge.
+
+**Verdict: PASS with a pre-merge condition.** No remediation plan is required; the outstanding gate is maintainer execution of the recorded manual checklist, which no code change can satisfy.
+
+## Rejected Scope Narrowing
+
+None. The caller prompt supplied the base branch, merge-base, feature folder, and work mode, and explicitly delegated scope determination to this agent ("Scope determination is yours"). It contained no instruction to limit review to a plan, phase, task, or file subset, and no instruction to mark any language's coverage verdict as anything other than an explicit verdict. The caller in fact directed the reviewer away from over-trusting the generated PR-context summary, which is consistent with the full-diff scope invariant. The audit was performed against the complete `003c5715...HEAD` three-dot diff.
+
+One upstream artifact defect was corrected rather than accepted (see Section 8, item 2): the generated PR-context summary classified every changed file as documentation, which would have caused the SubagentStop coverage gate to enumerate zero changed languages and skip enforcement entirely.
+
+## 1. General Unit Test Policy Compliance
+
+| Check | Verdict | Evidence |
+|---|---|---|
+| Independence (order-independent) | PASS | Every new test constructs its own `ConcurrentDictionary`, `Mock<IAppItemEngines>`, and sink list inside the test body. No static or shared mutable state is written. `EngineCommandCatalog` exposes only immutable read-only state. |
+| Isolation (one unit per test) | PASS | Each of the 45 added tests exercises a single member: `IsEngineReady`, `TryGetEngine`, `TryGetEngineName`, `ControlIds`, `IsCommandEnabled`, `RunAsync`, `InvalidateAll`, or one XML/reflection assertion. |
+| Fast execution | PASS | Measured this session: 69 tests in the `TaskMaster.Test.Ribbon` namespace complete in 0.69 s wall clock. |
+| Determinism | PASS | No sleep, delay, wall-clock read, temporary file, message pump, `Form`, `MessageBox`, or live COM appears in any added test. Verified by direct grep over `TaskMaster.Test/Ribbon/*.cs`. The one asynchronous-completion test drives a `TaskCompletionSource` that the test itself completes synchronously. |
+| Readability, AAA structure | PASS | Every added test carries explicit `// Arrange` / `// Act` / `// Assert` comments and a behaviour-named method name. Every assertion supplies a `because` reason string. |
+| Scenario completeness | PASS | Positive, negative, boundary (null / empty / whitespace / unknown id / ordinal case), error-propagation, and state-transition (empty dictionary mutated to populated between two probes) paths are all represented. |
+| No external dependencies | PASS | Moq doubles `IAppItemEngines` and `IConditionalEngine<MailItemHelper>`; the ribbon XML is read from the embedded manifest resource stream, not the filesystem. |
+| Test file location mirrors source | PASS | `TaskMaster/Ribbon/Foo.cs` maps to `TaskMaster.Test/Ribbon/FooTests.cs` for all four new types. No test file was placed in a production source tree. |
+| Coverage exclusion policy (no production path excluded) | PASS | No `coverage.config`, `.runsettings`, or exclusion configuration file appears in the branch diff. No `[ExcludeFromCodeCoverage]` attribute was added to any new type; verified by `grep -nE "^\s*\[ExcludeFromCodeCoverage\]" TaskMaster/Ribbon/Engine*.cs` returning no match. |
+
+### 1.2 Coverage Verification (mandatory for every language with changed files)
+
+Changed-language enumeration derived from `git diff --name-status 003c5715...HEAD`: **C# only**. The branch changes 10 `.cs` files, 2 `.csproj` files, and 1 embedded `.xml` UI resource; every remaining path is Markdown documentation, Markdown agent memory, or committed XML coverage summaries under the feature evidence tree.
+
+- TypeScript: zero changed files on the branch (no `.ts` or `.tsx` path appears in the diff); no verdict is required for a language with zero changed files.
+- Python: zero changed files on the branch (no `.py` path appears in the diff); no verdict is required for a language with zero changed files.
+- PowerShell: zero changed files on the branch (no `.ps1` or `.psm1` path appears in the diff); no verdict is required for a language with zero changed files.
+
+#### 1.2.1 C# coverage (changed language — explicit verdicts)
+
+Artifact: `artifacts/csharp/coverage.xml` (canonical path, JaCoCo package-counter format). Verified this session to be whitespace-identical to the committed `evidence/qa-gates/coverage-final.jacoco.xml`. Both were projected from the executor's post-change Cobertura run of `scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug`. Test assemblies are absent from the denominator; vendored third-party packages are excluded by `coverage.config`.
+
+- **C# repo-wide line coverage: 85.85% (95,473 covered / 111,207 valid) — PASS** (>= the 85% uniform floor in `.claude/rules/quality-tiers.md`, and >= the 80% floor in CLAUDE.md UT2). Independently summed from the nine `<counter type="LINE">` elements of `artifacts/csharp/coverage.xml`.
+  - Baseline: 85.85% (95,309 / 111,021) — `evidence/baseline/coverage-baseline.jacoco.xml`, captured at the merge-base before implementation.
+  - Post-change: 85.85% (95,473 / 111,207).
+  - Change: +0.0039 percentage points; +164 covered lines against +186 valid lines.
+  - Disposition: improvement. No regression.
+  - Evidence: `evidence/qa-gates/coverage-comparison.2026-08-08T14-56.md`; figures re-derived this session directly from the two committed JaCoCo summaries.
+- **C# repo-wide branch coverage: 79.25% (22,131 covered / 27,926 valid) — PASS** (>= the 75% uniform floor).
+  - Baseline: 79.24% (22,077 / 27,862). Post-change: 79.25% (22,131 / 27,926). Change: +0.0117 percentage points. Disposition: improvement.
+- **C# new-code line coverage: 100.00% (186 covered / 186 executable lines across the four new decision types) — PASS** (>= the 90% new-module floor in CLAUDE.md UT2 and >= the 85% uniform floor). Independently corroborated at package level: the `TaskMaster` package `LINE` counter moved from `missed=1464 covered=3329` to `missed=1464 covered=3515`. The missed count is byte-identical across the two measurements while covered rose by exactly 186, which is exactly the sum of the four new types' measured line counts (48 + 48 + 72 + 18). Had any of the 186 new lines been uncovered, the missed count would necessarily have risen.
+- **C# new-code branch coverage: 96.88% (62 covered / 64 new branches) — PASS** (>= the 75% uniform floor). Derived from the `TaskMaster` package `BRANCH` counter moving from `missed=387 covered=687` to `missed=389 covered=749`. The single documented uncovered branch is in `EngineGatedCommandRunner` (13 of 14, per `evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md`); a second missed branch entered the package counter and is not individually attributed in the surviving evidence. The package branch rate nevertheless rose from 63.97% to 65.82%.
+- **C# modified-file no-regression on changed lines — PASS.** The three modified production files (`RibbonViewer.cs`, `ThisAddIn.cs`, and the `RibbonExplorer.xml` resource) sit inside types that carry `[ExcludeFromCodeCoverage]` at the merge-base and still carry it at head, so no file moved from measured to unmeasured and no measured line lost coverage. The unchanged `missed=1464` figure for the whole `TaskMaster` package is the direct measurement supporting this.
+- **New production files: 6.** Four are the measured decision types at 100.00%. Two (`RibbonController.EngineCommands.cs`, `RibbonViewer.EngineCommands.cs`) are new partials of types that were already coverage-exempt at the merge-base; they add no new exemption and introduce no new attribute.
+
+Measurement note: the SubagentStop hook parses the canonical path with a JaCoCo `//counter` query and computes 85.85% line and 79.25% branch from this artifact, matching the figures above. The hook's parsers were invoked directly this session to confirm agreement.
+
+## 2. General Code Change Policy Compliance
+
+| Check | Verdict | Evidence |
+|---|---|---|
+| Simplicity first | PASS | Four small types totalling 388 lines, each with one responsibility. No new framework, no new abstraction layer, no new dependency. The guard is a single chokepoint rather than null-conditional operators scattered through eight handlers. |
+| Reusability | PASS | The control-id to engine-key binding lives in exactly one place (`EngineCommandCatalog.Map`) and is consumed by the XML regression test, the `getEnabled` decision, the click guard, and the refresh planner. Adding a future engine-backed command is a one-line change. |
+| Extensibility | PASS | Public behaviour is expressed through injected delegates (`Func<IAppItemEngines>`, `Action<string>`, `Action<string>` invalidator), so callers can extend without editing the decision types. |
+| Separation of concerns | PASS | Every decision is host-neutral and carries zero `Microsoft.Office.*` reference; the only new Office-typed member is one `getEnabled` shim on the pre-existing COM-visible viewer. Verified by grep over the four new decision files: the only occurrences of `Microsoft.Office` are inside XML doc comments asserting their absence. |
+| File size <= 500 lines (code and test files) | PASS | Measured with `awk NR`: EngineCommandCatalog.cs 88, EngineCommandRefreshPlanner.cs 58, EngineGatedCommandRunner.cs 139, EngineReadinessGate.cs 103, RibbonController.EngineCommands.cs 100, RibbonViewer.EngineCommands.cs 207, RibbonViewer.cs 388 (down from 487), ThisAddIn.cs 307, EngineCommandCatalogTests.cs 116, EngineCommandRefreshPlannerTests.cs 52, EngineGatedCommandRunnerTests.cs 346, EngineReadinessGateTests.cs 223, RibbonExplorerXmlTests.cs 309. The 487/500 pressure on `RibbonViewer.cs` was resolved by a partial-class split, which is the correct mechanism. |
+| Embedded UI resource size | Exception recorded | `RibbonExplorer.xml` moved from 519 to 539 lines. It was already above 500 at the merge-base. It is a declarative embedded resource rather than production, test, or reusable script code, and `spec.md` AC25 records the overage as an accepted pre-existing exception. See Section 8, item 1. |
+| Error handling — fail fast, no silent catches | PASS | `git diff 003c5715...HEAD -- '*.cs' \| grep "^+.*catch"` matches exactly one added line, which is prose inside an XML doc comment. No `catch` clause of any kind was added. Constructor preconditions throw `ArgumentNullException`; the guard suppresses invocation only and re-raises nothing, so an exception from a ready action propagates unchanged. |
+| Logging pattern | PASS | The blocked-click notice uses the existing `logger.Warn` plus `MessageBox.Show` mechanism already used at six sites in the ribbon layer. No `Console.WriteLine` or ad-hoc output was added. |
+| Naming | PASS | PascalCase types and members, camelCase locals and parameters, descriptive non-cryptic names throughout. |
+| Public API compatibility | PASS | `IAppItemEngines` gains no member. All four decision types are `internal`. The one new `public` member is the required Office callback on an existing public type. Every existing test double compiles unmodified; no test-double file appears in the diff. |
+| Dependencies | PASS | No package reference, project reference, or `packages.config` entry changed. The two `.csproj` edits are `<Compile Include>` registrations required by the legacy non-SDK project format. |
+| I/O boundaries | PASS | The four decision types touch no disk, network, or COM. `EngineReadinessGate` performs one lock-free `ConcurrentDictionary.TryGetValue` plus null checks. |
+| Bugfix workflow — failing regression test first | PASS | `evidence/regression-testing/fail-before-503.2026-08-08T13-22.md` and `fail-before-exception.2026-08-08T13-23.md` record the red state before the fix; `pass-after-503.2026-08-08T13-32.md` records the green state after. |
+| Toolchain loop restarts honoured | PASS | `evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md` records three entries into the Phase 6 loop, with the first two restarted (formatter rewrote files; nullable verification surfaced three diagnostics) and the third clean. MD5 fingerprints of all 16 touched paths, captured at both ends of the clean pass, are identical to the files on disk today. |
+
+## 3. Language-Specific Code Change Policy Compliance (C#)
+
+| Check | Verdict | Evidence |
+|---|---|---|
+| Formatting — CSharpier | PASS | Re-run this session: `csharpier check .` returned exit 0 over 1498 files. |
+| Linting — .NET analyzers | PASS | Re-run this session: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` returned exit 0 with every project emitting an assembly. Only the pre-existing `System.Reactive` packages.config advisory warning appears. |
+| Type checking — nullable analysis | PASS | Re-run this session: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true` returned exit 0 with 0 errors. Independently strengthened by a forced `/t:Rebuild` of `TaskMaster\TaskMaster.csproj` under the same properties, which surfaced 195 errors of which 64 are `CS86xx` and **0 are in any of the six new production files**. See Section 8, item 3. |
+| `dotnet format` avoided | PASS | Not present in any evidence artifact or plan step. |
+| Strong contracts and explicit APIs | PASS | Every public and internal member carries XML documentation stating inputs, outputs, and failure modes. Explicit types are used at all boundaries. |
+| Null safety | PASS | Three null-forgiving operators are used, each with an adjacent comment recording why null is a supported value rather than a defect: `TryGetEngineName`'s `out` parameter on the false path, `() => Globals?.Engines!`, and `control?.Id!`. Each corresponds to a documented contract enforced by a unit test. |
+| Composition over inheritance | PASS | All four types are sealed or static; none introduces an inheritance hierarchy. Behaviour is composed through injected delegates. |
+| Async and resource safety | PASS | `RunAsync` returns `Task` rather than being `async void`; it awaits nothing itself and returns the action's task directly, preserving the caller's await. No disposable is introduced. |
+| Internal-first public surface | PASS | Four of the five new types are `internal`; `InternalsVisibleTo("TaskMaster.Test")` already existed, so no visibility widening was needed for testability. |
+| Architecture boundaries (`.claude/rules/architecture-boundaries.md`) | PASS | Rule 3: no new `[ComVisible(true)]` type; grep over the diff shows the only added `ComVisible` occurrence is prose in an XML doc comment. Rules 1, 2, 4: the sole new Office-typed member is `public bool EngineCommand_GetEnabled(Office.IRibbonControl)` inside the pre-existing COM-visible shim. Rule 8: all readiness, catalog, guard, and refresh-planning behaviour is host-neutral and would port unchanged to a non-desktop command surface. |
+
+## 4. Language-Specific Unit Test Policy Compliance (C#)
+
+| Check | Verdict | Evidence |
+|---|---|---|
+| MSTest framework | PASS | All four new test classes use `[TestClass]`, `[TestMethod]`, and `[DataTestMethod]`/`[DataRow]` from `Microsoft.VisualStudio.TestTools.UnitTesting`. No xUnit or NUnit reference was introduced. |
+| Moq for mocking | PASS | `new Mock<IAppItemEngines>()` and `new Mock<IConditionalEngine<MailItemHelper>>()` are the only doubles used. |
+| FluentAssertions for assertions | PASS | Every assertion in the 45 added tests uses `.Should()`. No bare MSTest `Assert` call appears in the new files. |
+| Deterministic test rules | PASS | No network, no filesystem, no clock, no external process, no implicit working directory. The XML is read through `GetManifestResourceStream`. |
+| DI seams | PASS | Injectable-delegate seams (`Func<IAppItemEngines>`, `Action<string>`) are used where a full interface would be excessive, which is option 2 of the prescribed ordering, and the boundary being wrapped is a property read plus a notification sink. |
+| Banned symbols | PASS | Grep for `Thread.Sleep`, `Task.Delay`, `DateTime.Now`, `DateTime.UtcNow`, `Path.GetTempPath`, `new Form`, `MessageBox`, and `Application.Run` across `TaskMaster.Test/Ribbon/*.cs` returns no match. The BannedApiAnalyzers stage is part of the passing analyzer build. |
+| Readiness not reached through side-effecting getters | PASS | No test touches `RibbonController.SB`, `Triage`, or `TriageAsync`, each of which installs a real `WindowsFormsSynchronizationContext` on the calling thread. The gate is exercised through its injected accessor. |
+
+## 5. Test Coverage Detail
+
+| Scope | Line | Branch | Verdict |
+|---|---|---|---|
+| Repository, first-party denominator | 85.85% (95,473/111,207) | 79.25% (22,131/27,926) | PASS |
+| `TaskMaster` package | 70.60% (3,515/4,979) | 65.82% (749/1,138) | Pre-existing sub-floor package, improved by this change from 69.46% / 63.97%. Not a gate for this feature; the repository denominator is the policy denominator and it passes. |
+| `EngineCommandCatalog` | 100.00% (48/48) | 100.00% | PASS |
+| `EngineReadinessGate` | 100.00% (48/48) | 100.00% | PASS |
+| `EngineGatedCommandRunner` | 100.00% (72/72) | 92.86% (13/14) | PASS |
+| `EngineCommandRefreshPlanner` | 100.00% (18/18) | 100.00% | PASS |
+| `RibbonController.EngineCommands.cs`, `RibbonViewer.EngineCommands.cs` | not measured | not measured | Inside types already carrying `[ExcludeFromCodeCoverage]` at the merge-base; no new exemption introduced. |
+
+## 6. Test Execution Metrics
+
+| Metric | Value | Source |
+|---|---|---|
+| Full-suite tests, merge-base | 6,293 passed, 0 failed, 0 skipped | `evidence/baseline/tests-with-coverage.2026-08-08T13-11.md` |
+| Full-suite tests, head | 6,338 passed, 0 failed, 0 skipped | `evidence/qa-gates/tests-with-coverage.2026-08-08T14-52.md` |
+| Tests added by this change | 45 | Delta above; matches the enumerated per-class counts including data-row expansion |
+| Re-run this session, `TaskMaster.Test.Ribbon` namespace | 69 passed, 0 failed, exit 0 | `vstest.console.exe TaskMaster.Test\bin\Debug\TaskMaster.Test.dll /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon'` using the `Common7\IDE\Extensions\TestPlatform` binary |
+| Wall clock, re-run | 0.69 s | Same run |
+| Known pre-existing flake | `UtilitiesCS.Test...WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict`, tracked as #508; passed on both the baseline and head full-suite runs | `evidence/baseline/preexisting-failures.2026-08-08T13-12.md` |
+
+## 7. Code Quality Checks
+
+| Check | Result |
+|---|---|
+| Formatting, re-run this session | PASS — exit 0, 1498 files |
+| Analyzer build, re-run this session | PASS — exit 0, all assemblies emitted |
+| Type-check build, re-run this session | PASS — exit 0, 0 errors |
+| Forced-rebuild type-check of the changed project | PASS for authored code — 0 errors of any kind attributable to the six new production files |
+| New-type unit tests, re-run this session | PASS — 69/69 |
+| Attribute census | PASS — no `[ExcludeFromCodeCoverage]` and no `[ComVisible(true)]` added to any type |
+| Broad-catch census | PASS — zero `catch` clauses added anywhere in the diff |
+| Evidence integrity | PASS — canonical `artifacts/csharp/coverage.xml` whitespace-identical to the committed final JaCoCo summary; source MD5 fingerprints recorded in the clean-pass artifact match the files on disk |
+| Zero-line-diff constraint on fenced files | PASS — `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, and `TaskMaster/AppGlobals/ApplicationGlobals.cs` do not appear in `git diff --name-status 003c5715...HEAD` |
+
+## 8. Gaps and Exceptions
+
+1. **`RibbonExplorer.xml` grew from 519 to 539 lines** while already above the 500-line limit. The file is a declarative embedded UI resource, not production, test, or reusable script code, and `spec.md` AC25 records the overage as an accepted pre-existing exception that this bug fix does not remediate. Recorded as an exception rather than a policy FAIL, but noted that only 8 of the 23 added lines are functionally required: the three `TriageSet*` buttons were reformatted from one line each to six lines each, which added 12 avoidable lines to an already-oversized file. Non-blocking.
+
+2. **PR-context summary misclassification.** The generated overview reported "Core logic changes: 0 files" and folded all 16 changed C# and project paths into the documentation bucket. This is the same recurring generator defect observed on prior C#-touching reviews. Its practical consequence here is specific: `Get-ChangedLanguageSet` in `.claude/hooks/validate-feature-review-coverage.ps1` derives changed languages from that section, so the uncorrected summary caused the hook to enumerate zero languages and skip every coverage check. The summary was corrected in place this session with an annotated correction block listing the 16 core-logic paths; the hook now enumerates `CSharp` and evaluates the coverage rows above. The underlying generator defect remains open tooling debt.
+
+3. **The mandated type-check gate is incremental-vacuous.** `msbuild TaskMaster.sln /t:Build /p:Nullable=enable /p:TreatWarningsAsErrors=true` returns exit 0, but MSBuild's up-to-date check skips `CoreCompile` when only `/p:` values change, so the exit code alone does not establish that the tree is nullable-clean. Independently confirmed: a forced `/t:Rebuild` of `TaskMaster\TaskMaster.csproj` under the same properties returns exit 1 with 195 errors, 64 of them `CS86xx`, concentrated in untouched files (`OutlookItemTry.cs` 35, `OutlookItemFlaggableTry.cs` 30, `ItemInfo.cs` 20, `PropertyStore.cs` 17). **Zero** errors are attributable to any of the six new production files. This is pre-existing repository debt, was discovered and recorded by the executor (`evidence/qa-gates/msbuild-nullable.2026-08-08T14-49.md`), and is routed for promotion in `evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md`. Non-blocking for this feature; the gate defect itself warrants a governance issue.
+
+4. **Coverage evidence reproducibility was reduced after the fact.** Commit `d0955dc4` replaced the two committed full-detail Cobertura reports (~20 MB, ~374,000 lines) with package-level JaCoCo summaries. The substitution is documented and the aggregate figures were verified lossless, but the per-file and per-type tables in `new-type-coverage.2026-08-08T14-54.md` and `coverage-comparison.2026-08-08T14-56.md` can no longer be re-derived from committed artifacts alone. This audit therefore corroborated AC23 by an independent route: the `TaskMaster` package missed-line count is identical across the two measurements while covered rose by exactly 186, the exact line total of the four new types. The size concern that motivated the substitution is legitimate; the trade-off should be made a documented repository convention rather than a per-feature decision.
+
+5. **AC29 promotion receipts are not independently verifiable.** The GitHub CLI is unavailable in this environment, so the existence and content of issues #504 through #508 could not be confirmed. The five corresponding local entries under `docs/features/potential/promoted/` are present in the diff, and the in-repo half of the claim is verified. The GitHub half is UNVERIFIED for the stated environmental reason.
+
+6. **Test-runner selection is unpinned.** CLAUDE.md CUT3 prescribes `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage` without naming which of the two installed binaries to use or requiring `/Settings:TaskMaster.runsettings`. Running the changed assembly under `Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` without runsettings produced 26 spurious failures, all a `System.Threading.Tasks.Extensions, Version=4.2.0.1` assembly-load failure inside `Moq.Async.AwaitableFactory` caused by the app.config binding redirect not being applied. The same tests pass 69/69 under `Common7\IDE\Extensions\TestPlatform\vstest.console.exe` with the runsettings file, which is what `scripts/vscode/Invoke-MSTestWithCoverage.ps1` resolves. Three unrelated pre-existing tests failed identically, confirming an environment artifact rather than a defect in this change. Documentation debt, not a defect in this feature.
+
+7. **`coverage-artifact-substitution.2026-08-08T17-40.md` is future-dated.** Its filename timestamp is 17-40 while the commit that introduced it is dated 14:05 and the current wall clock is 14:1x. Cosmetic; it breaks chronological ordering of the evidence tree.
+
+8. **MCP template resolution was unavailable.** `mcp__drm-copilot__resolve_policy_audit_template_asset` and `mcp__drm-copilot__validate_orchestration_artifacts` are not exposed in this session, so the three review artifacts were authored against the canonical heading set enumerated in `.claude/skills/policy-audit-template-usage/SKILL.md` and the structure of the most recent accepted audit in this repository. Recorded as an assumption.
+
+9. **AC19, AC20, and AC21 remain unverified by design.** They require a live Outlook process and mail profile, which the general unit-test policy forbids automated tests from depending on. The maintainer checklist at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` carries `Status: PENDING MAINTAINER EXECUTION`. They are correctly left unchecked in `spec.md`; checking them off from unit-test evidence would violate the criteria's own text.
+
+## 9. Summary of Changes
+
+- New production: `TaskMaster/Ribbon/EngineCommandCatalog.cs` (88), `EngineReadinessGate.cs` (103), `EngineGatedCommandRunner.cs` (139), `EngineCommandRefreshPlanner.cs` (58) — four host-neutral `internal` decision types, none coverage-exempt, all at 100.00% line coverage.
+- New shims: `RibbonController.EngineCommands.cs` (100) and `RibbonViewer.EngineCommands.cs` (207) — partials of pre-existing `[ExcludeFromCodeCoverage]` types carrying the lazily-built runner, the Office `getEnabled` callback, the dispatcher-marshalled invalidation, and the eight relocated-and-guarded click handlers.
+- Modified production: `RibbonViewer.cs` 487 to 388 lines via a partial-class split (`class` to `partial class`, two regions relocated); `ThisAddIn.cs` +7 lines (one refresh call plus a why-comment); `RibbonExplorer.xml` +23/-3 (eight `getEnabled` attributes plus reformatting of three buttons); two `.csproj` files gaining `<Compile Include>` entries.
+- New tests: 45 across `EngineCommandCatalogTests` (116), `EngineCommandRefreshPlannerTests` (52), `EngineGatedCommandRunnerTests` (346), `EngineReadinessGateTests` (223), plus four additions to `RibbonExplorerXmlTests` (161 to 309).
+- Docs and evidence: full feature folder (issue, spec, research, plan) plus 39 evidence artifacts under `evidence/baseline/`, `evidence/regression-testing/`, `evidence/qa-gates/`, `evidence/manual-verification/`, `evidence/issue-updates/`, and `evidence/other/`; five promoted potential-defect entries.
+- Agent memory: atomic-executor, atomic-planner, prd-feature, and task-researcher Markdown memory updates.
+
+## 10. Compliance Verdict
+
+**PASS with a pre-merge condition.** Every policy gate passes on independent re-verification this session or on committed final-pass evidence that was cross-checked against the current working tree. Coverage clears every applicable floor at the repository, new-code, and changed-line level, and improved marginally against the captured merge-base baseline. No finding is blocking and no remediation plan is required; the three Medium findings are a test-robustness weakness compensated by a sibling assertion, a pre-existing toolchain-gate defect with zero impact on the authored code, and a size increase to a resource file already outside the limit by an accepted exception.
+
+Recommendation: **conditional GO for PR.** The named condition is maintainer execution of `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` against a live Outlook profile, recording the outcome under `evidence/manual-verification/`, before merge. No code change can satisfy that condition; it is a live-host verification of Office callback binding and cache invalidation, which `spec.md` Rollout already names as a pre-merge step.
+
+## Evidence Location Compliance
+
+- Scan of the full branch diff for files written under `artifacts/baselines/`, `artifacts/baseline/`, `artifacts/qa/`, `artifacts/qa-gates/`, `artifacts/evidence/`, `artifacts/coverage/`, `artifacts/regression-testing/`, or `artifacts/post-change/`: **zero occurrences.** All 39 evidence artifacts live under the canonical `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/<kind>/` tree.
+- `validate_evidence_locations.py` does not exist in this repository (no `scripts/dev_tools/` directory; confirmed by search). The equivalent check was performed manually against the complete diff file list.
+- `artifacts/csharp/coverage.xml` is the allowed canonical gate-artifact path, is gitignored, and is not a diff-committed evidence file.
+- No `EVIDENCE_LOCATION_OVERRIDE_REJECTED` condition arose; the caller supplied no non-canonical evidence path.
+
+## Appendix A: Test Inventory
+
+Tests added by this change (45 including data-row expansion):
+
+1. `EngineReadinessGateTests` (11 methods, 13 cases): IsEngineReady_WhenAccessorReturnsNull_ReturnsFalse; IsEngineReady_WhenInboxEnginesIsNull_ReturnsFalse; IsEngineReady_WhenInboxEnginesIsEmpty_ReturnsFalse; IsEngineReady_WhenKeyPresentWithNonNullEngine_ReturnsTrue; IsEngineReady_WhenKeyPresentWithNullValue_ReturnsFalse; IsEngineReady_WithNullOrWhitespaceName_ReturnsFalse (3 rows); IsEngineReady_IsOrdinalCaseSensitive; IsEngineReady_AfterDictionaryPopulated_ReturnsTrue; TryGetEngine_WhenReady_OutputsSameInstance; TryGetEngine_WhenNotReady_OutputsNull; Constructor_WithNullAccessor_ThrowsArgumentNullException.
+
+2. `EngineCommandCatalogTests` (6 methods, 13 cases): the 8-row control-id to engine-key mapping; unknown id; null id; empty id; ControlIds set equality; ControlIds duplicate-free.
+
+3. `EngineGatedCommandRunnerTests` (13 methods): RunAsync_WhenEngineNotReady_DoesNotThrowNullReferenceException; RunAsync_WhenEngineNotReady_DoesNotThrowKeyNotFoundException; RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName; RunAsync_WhenEngineReady_InvokesActionExactlyOnce; RunAsync_WhenEngineReady_AwaitsActionToCompletion; RunAsync_WhenActionThrows_PropagatesException; RunAsync_WithUnknownControlId_DoesNotInvokeAction; RunAsync_WithNullAction_ThrowsArgumentNullException; IsCommandEnabled_WhenEngineNotReady_ReturnsFalse; IsCommandEnabled_WhenEngineReady_ReturnsTrue; IsCommandEnabled_WithUnknownControlId_ReturnsFalse; Constructor_WithNullGate_ThrowsArgumentNullException; Constructor_WithNullNotificationSink_ThrowsArgumentNullException.
+
+4. `EngineCommandRefreshPlannerTests` (2): InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId; InvalidateAll_WithNullDelegate_ThrowsArgumentNullException.
+
+5. `RibbonExplorerXmlTests` additions (4): RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback; RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls; RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled; RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer.
+
+Full-suite context: 6,338 tests across the solution's test assemblies, all passing in the executor's final unattended run.
+
+## Appendix B: Toolchain Commands Reference
+
+Commands executed this session (all check-only except the two builds, which write only to `bin`/`obj`):
+
+- `git merge-base HEAD origin/main` -> `003c5715055d7d1933db68a742531332756e30b2`
+- `git rev-parse HEAD` -> `d0955dc4c7be61b654dbeb0804d5520fde5a5a4c`
+- `git diff --name-status 003c5715055d7d1933db68a742531332756e30b2...HEAD` (scope derivation)
+- `git diff --numstat 003c5715055d7d1933db68a742531332756e30b2...HEAD` (language enumeration and line deltas)
+- `C:\Users\DanMoisan\.dotnet\tools\csharpier.exe check .` -> exit 0, 1498 files
+- `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` -> exit 0
+- `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true` -> exit 0
+- `msbuild TaskMaster\TaskMaster.csproj /t:Rebuild /p:Configuration=Debug /p:Nullable=enable /p:TreatWarningsAsErrors=true` -> exit 1, 195 errors, 0 in authored files (forced-recompile verification of the gate above)
+- `vstest.console.exe TaskMaster.Test\bin\Debug\TaskMaster.Test.dll /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon'` -> exit 0, 69/69 passed
+- `awk 'END{print NR}'` over every changed non-Markdown path (file-size measurement; `Measure-Object -Line` deliberately avoided because it undercounts)
+- `md5sum` over the 9 touched source paths, compared against the fingerprints in `evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-58.md`
+- Direct XML summation over `artifacts/csharp/coverage.xml` and the two committed JaCoCo summaries for all coverage figures
+- `.claude/hooks/validate-feature-review-coverage.ps1` dot-sourced and its `Get-ChangedLanguageSet`, `Get-LanguageRepoCoverage`, and `Get-LanguageBranchCoverage` parsers invoked directly against the live artifacts
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T15-40.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T15-40.md
new file mode 100644
index 000000000..872d3f3e5
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/policy-audit.2026-08-08T15-40.md
@@ -0,0 +1,356 @@
+# Policy Compliance Audit — ribbon-engine-readiness-guard (Issue #503)
+
+- Audit timestamp: 2026-08-08T15-40
+- Cycle: **re-audit following remediation cycle 1**
+- Base branch: `main`
+- Merge-base: `003c5715055d7d1933db68a742531332756e30b2` (recomputed in-session via `git merge-base HEAD origin/main`; matches the supplied value)
+- Feature branch: `bug/ribbon-engine-readiness-guard-503`
+- Head: `85ff0ee4f0579a3622f2da3a21a6e942b3e4cd12` (matches the PR-context `Head ref (resolved)`; artifacts are current, not stale)
+- Work mode: `full-bug` → sole AC source is `spec.md`
+- Working tree: clean at audit time
+
+## Executive Summary
+
+**Verdict: PASS.** Zero Blocking findings, zero High findings. The branch is recommended for PR, subject to the one pre-merge maintainer action recorded below.
+
+This is the second review of this branch. The first review (`policy-audit.2026-08-08T14-15.md`) returned PASS with two discretionary Medium findings. Both were re-examined against the tree in this cycle rather than accepted on report:
+
+- **F1 (vacuous `?.` assertion in the AC5 ribbon-XML test) — verified remediated.** The corrected assertion is present at `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs:201-214`, and the recorded mutate/fail/restore proof is genuine and rigorous (see §1.1).
+- **F2 (`RibbonExplorer.xml` line growth) — verified correctly escalated, not remediable as specified.** The executor's formatter-conflict claim was **independently reproduced in this session** rather than accepted (see §2.2). The 12 additional lines are formatter-mandated, not incidental churn.
+
+Repo-wide C# coverage clears both the 85% line floor and the 75% branch floor, all four new decision types are at 100% line coverage, and no changed line regressed.
+
+The one item that is not verifiable in this environment is the MANUAL-ONLY set AC19/AC20/AC21, which requires a live Outlook profile. These are unchecked by design and constitute a maintainer pre-merge action, not a remediation trigger (justified in §8).
+
+## Rejected Scope Narrowing
+
+None. The caller prompt supplied the correct base branch and merge-base, explicitly stated "Same inputs as the original review, no scope narrowing", instructed that scope determination is the reviewer's own, and directed that both remediation claims be assessed against the tree rather than accepted. No instruction attempted to limit the audit to a plan subset, to a file subset, or to mark any language as excluded from verification. The audit was performed against the full branch diff versus the resolved base branch.
+
+One caller statement was checked and found benign rather than narrowing: the prompt describes `artifacts/` as gitignored and local-only. That is a factual statement about artifact durability, not an instruction to skip a check; the canonical C# artifact was read and parsed in full.
+
+## Scope Determination (performed independently)
+
+Derived from `git diff --name-status 003c5715..85ff0ee4`, not from the PR-context overview.
+
+| Bucket | Count | Notes |
+|---|---|---|
+| C# source (`.cs`) | 13 | 10 added, 3 modified |
+| Embedded UI resource (`.xml`) | 1 | `TaskMaster/Ribbon/RibbonExplorer.xml` (modified) |
+| Project files (`.csproj`) | 2 | explicit `<Compile Include>` registration (legacy non-SDK projects) |
+| Documentation / evidence / agent-memory (`.md`, evidence XML) | 107 | feature folder, promoted potential entries, agent memory |
+
+Languages with changed files on the branch: **C# only.** TypeScript, Python, and PowerShell each have zero changed files.
+
+### PR-context defect found and corrected
+
+`artifacts/pr_context.summary.txt` reported `Core logic changes: 0 files` and swept all 16 code paths into the `Docs/templates/agents/tooling` bucket. This is a recurring generator defect on C#-touching branches and it is not cosmetic: `.claude/hooks/validate-feature-review-coverage.ps1` derives its changed-language set from those bullet lines, so with the original text the branch presented as having zero C# files and per-language coverage enforcement would have been silently skipped. The overview was corrected in place under a clearly labelled `[REVIEWER CORRECTION]` block that preserves the original generator output for audit. After correction, a simulation of `Get-ChangedLanguageSet` against the summary returns `[CSharp]`, and the JaCoCo parser returns 85.86% line / 79.27% branch.
+
+## 1. General Unit Test Policy Compliance
+
+**Verdict: PASS.**
+
+| Requirement | Evidence | Verdict |
+|---|---|---|
+| Independence | No shared mutable state between tests; every test constructs its own `ConcurrentDictionary`, gate, and runner | PASS |
+| Isolation | One behaviour per `[TestMethod]`; failures name the specific unit | PASS |
+| Fast execution | Pure in-memory decision logic; no I/O, no process, no host | PASS |
+| Determinism | No wall-clock read, no `Thread.Sleep`, no `Task.Delay`, no RNG; the async completion test is driven by a `TaskCompletionSource` completed synchronously by the test | PASS |
+| Readability | Descriptive names, Arrange–Act–Assert sections marked by comment, `because` reasons on assertions | PASS |
+| No external dependencies | No network, no database, no live COM, no Outlook process | PASS |
+| No temporary files | Verified by grep over the five new/changed test files | PASS |
+| Test file location | Tests live under `TaskMaster.Test/Ribbon/`, mirroring `TaskMaster/Ribbon/`; no colocation in the production tree | PASS |
+| Scenario completeness | Positive, negative, boundary, error-propagation, and state-transition cases all present (see §1.1) | PASS |
+
+Banned-API grep over `TaskMaster.Test/Ribbon/Engine*Tests.cs` and `RibbonExplorerXmlTests.cs` for `Thread.Sleep|Task.Delay|DateTime.Now|DateTime.UtcNow|Random.Shared|new Form|MessageBox|Path.GetTempFileName|GetTempPath|Application.Run` returned zero matches.
+
+### 1.1 F1 re-verification — the AC5 assertion is non-vacuous
+
+The prior review found `...Attribute("getEnabled")?.Value.Should().Be(...)`, where the null-conditional short-circuits the entire chain including `.Should()`, so an absent attribute produced a silent pass on exactly the regression the test names.
+
+Current source (`RibbonExplorerXmlTests.cs:201-214`) binds the attribute to a local, asserts `NotBeNull`, and only then dereferences `.Value`:
+
+```csharp
+var getEnabled = elementsById[controlId].Attribute("getEnabled");
+getEnabled.Should().NotBeNull("control '{0}' is engine-backed and must declare a getEnabled callback", controlId);
+getEnabled!.Value.Should().Be(EngineCommandGetEnabledCallback, ...);
+```
+
+All three required failure conditions now reach a real assertion: attribute missing (via `NotBeNull`), attribute present with the wrong value, and attribute present but empty (both via `.Value.Should().Be(...)`, reached unconditionally once the attribute exists).
+
+The recorded proof is genuine and unusually rigorous for a mutation claim. It is not a bare assertion of correctness:
+
+- The mutation was applied to the **embedded resource inside the built assembly**, and `f1-mutated-assembly.2026-08-08T14-52.md` records `EMBEDDED_GETENABLED_COUNT=7` read back out of `TaskMaster.Test\bin\Debug\TaskMaster.dll`, with the assembly write time advancing past the pre-mutation value. A stale-assembly explanation is therefore excluded.
+- A control run against the **unmutated** resource is recorded green at 8/8 (`f1-green-before-mutation`), so the failure is attributable to the mutation and not to the assertion edit.
+- The failure message is verbatim and the stack frame names `ReferenceTypeAssertions.NotBeNull` at `RibbonExplorerXmlTests.cs:line 202` — the exact line introduced by the fix.
+- The AC6 sibling set-equality test failed on the same mutation through an independent route, corroborating that the mutation reached the assembly.
+- Restoration is recorded, and the permanent tree retains no part of the mutation (confirmed independently: `git hash-object TaskMaster/Ribbon/RibbonExplorer.xml` = `9d8403ee3d2e7f02c6d29d73efb25f9e065b461e`, matching the committed blob).
+
+F1 is closed.
+
+### 1.2 Coverage Verification (mandatory for every language with changed files)
+
+Coverage was verified by inspecting the pre-existing artifact produced during execution. It was not regenerated.
+
+Canonical artifact `artifacts/csharp/coverage.xml` is present, is JaCoCo-format, and is **current for HEAD**: its counters are identical in every package to `evidence/qa-gates/coverage-remediation-final.jacoco.xml`, the post-remediation measurement.
+
+#### 1.2.1 C# coverage (changed language — explicit verdicts)
+
+- C# repo-wide line coverage: Baseline: 85.8477%. Post-change: 85.8561%. Change: +0.0084 points. Floor: 85%. Disposition: **PASS**. Evidence: `artifacts/csharp/coverage.xml` (95478 covered / 111207 valid), baseline `evidence/baseline/coverage-baseline.jacoco.xml` (95309 / 111021).
+- C# repo-wide branch coverage: Baseline: 79.2370%. Post-change: 79.2702%. Change: +0.0332 points. Floor: 75%. Disposition: **PASS**. Evidence: same artifacts (22137 covered / 27926 valid).
+- C# new/changed-code coverage: **100.0000%** line coverage across all four new decision types. Floor: 85% line and 75% branch for new files, and the stricter 90% CLAUDE.md new-module floor. Disposition: **PASS**. Evidence: `evidence/qa-gates/new-type-coverage.2026-08-08T14-54.md` and the package-counter proof below.
+- C# modified-file coverage and changed-line no-regression: no changed line lost coverage. Disposition: **PASS**. Evidence: package-counter proof below.
+
+Per-file new-code figures (from the per-type measurement, corroborated independently below):
+
+| New file | Measurable lines | Covered | Line coverage | Floor | Verdict |
+|---|---|---|---|---|---|
+| `TaskMaster/Ribbon/EngineCommandCatalog.cs` | 48 | 48 | 100.0000% | 90% | PASS |
+| `TaskMaster/Ribbon/EngineReadinessGate.cs` | 48 | 48 | 100.0000% | 90% | PASS |
+| `TaskMaster/Ribbon/EngineGatedCommandRunner.cs` | 72 | 72 | 100.0000% | 90% | PASS |
+| `TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs` | 18 | 18 | 100.0000% | 90% | PASS |
+
+**Independent corroboration (package-counter delta).** The canonical artifact carries package-level counters only, with per-class detail stripped, so the per-type figures were re-derived rather than taken on trust. Comparing the merge-base baseline against the canonical artifact:
+
+| Package | LINE missed | LINE covered | Valid delta |
+|---|---|---|---|
+| `TaskMaster` | 1464 → 1464 (**+0**) | 3329 → 3515 (**+186**) | +186 |
+
+The `TaskMaster` package gained exactly 186 valid lines and covered **all** of them, while `missed` is byte-identical at 1464 across all four measurement points (merge-base baseline, implementation final, remediation baseline, remediation final). 186 is exactly the sum of the four new types' measurable lines (48+48+72+18). This single counter pair simultaneously proves the new-code floor (every new measurable line is covered) and changed-line no-regression (not one previously-covered production line in `TaskMaster` flipped to missed).
+
+**Movement in untouched packages, assessed and dismissed as measurement noise.** Between the merge-base baseline and the canonical artifact, `QuickFiler` shows missed +1 / covered -1 and `UtilitiesCS` shows missed +16 / covered -16, both with a **valid delta of zero** — that is, lines changing state with no code change. No file under `QuickFiler/` or `UtilitiesCS/` appears anywhere in the branch diff. This was tested rather than assumed: two coverage runs over identical production code (`coverage-remediation-baseline` versus `coverage-remediation-final`; the remediation cycle changed only a test file) move `UtilitiesCS` by ±12 lines and `QuickFiler` by ±1 on an unchanged denominator. The observed drift is the same phenomenon and the same order of magnitude, and is attributable to test-execution nondeterminism already catalogued on this branch as a promoted potential entry (`2026-08-08-wpf-dispatcher-yield-test-order-dependent.md`). It is not a regression caused by this change.
+
+#### 1.2.2 Languages with zero changed files
+
+| Language | Changed files | Coverage verdict |
+|---|---|---|
+| TypeScript | 0 | N/A — zero changed files on the branch |
+| Python | 0 | N/A — zero changed files on the branch |
+| PowerShell | 0 | N/A — zero changed files on the branch |
+
+## 2. General Code Change Policy Compliance
+
+**Verdict: PASS**, with one recorded exception (§2.2).
+
+| Requirement | Assessment | Verdict |
+|---|---|---|
+| Simplicity first | Four small single-responsibility types; no framework, no indirection beyond one injected delegate | PASS |
+| Reusability | The control-id → engine-key binding is centralized in one catalog consumed by four call sites instead of duplicated | PASS |
+| Extensibility | Adding a future engine-backed command is a single `Map` entry | PASS |
+| Separation of concerns | Decision logic is host-neutral and COM-free; presentation and the COM call sit behind injected delegates in the pre-existing exempt shims | PASS |
+| Fail fast | Constructor and argument preconditions throw `ArgumentNullException`; no silent failure paths | PASS |
+| No broad catch | Zero `catch` clauses added anywhere in the diff (grep over `^\+.*\bcatch\b` returns only prose in XML doc comments) | PASS |
+| Logging pattern | Uses the established `logger.Warn` plus the repository's existing user-notice mechanism; no ad-hoc console output | PASS |
+| Explicit imports, no cycles | The four decision types import only `System.*` and `UtilitiesCS` | PASS |
+| No breaking public API change | `IAppItemEngines` untouched; only addition is one `public` COM callback on an existing type | PASS |
+| Bugfix workflow (failing test first) | Recorded: `evidence/regression-testing/fail-before-503.2026-08-08T13-22.md` and `fail-before-exception.2026-08-08T13-23.md` precede `pass-after-503.2026-08-08T13-32.md` | PASS |
+| Minimal targeted fix | Out-of-scope defects discovered during execution were promoted to separate issues rather than fixed in place (six entries under `docs/features/potential/promoted/`) | PASS |
+
+### 2.1 File size limit (500 lines)
+
+Every changed `.cs` file is under the cap, measured directly:
+
+| File | Lines | Cap | Verdict |
+|---|---|---|---|
+| `TaskMaster/Ribbon/RibbonViewer.cs` | 388 (was 487) | 500 | PASS |
+| `TaskMaster/Ribbon/RibbonViewer.EngineCommands.cs` | 207 | 500 | PASS |
+| `TaskMaster/Ribbon/EngineGatedCommandRunner.cs` | 139 | 500 | PASS |
+| `TaskMaster/Ribbon/EngineReadinessGate.cs` | 103 | 500 | PASS |
+| `TaskMaster/Ribbon/RibbonController.EngineCommands.cs` | 100 | 500 | PASS |
+| `TaskMaster/Ribbon/EngineCommandCatalog.cs` | 88 | 500 | PASS |
+| `TaskMaster/Ribbon/EngineCommandRefreshPlanner.cs` | 58 | 500 | PASS |
+| `TaskMaster/ThisAddIn.cs` | 307 | 500 | PASS |
+| `TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs` | 346 | 500 | PASS |
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | 318 | 500 | PASS |
+| `TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs` | 223 | 500 | PASS |
+| `TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs` | 116 | 500 | PASS |
+| `TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs` | 52 | 500 | PASS |
+
+The `RibbonViewer.cs` partial split was necessary, not cosmetic: the file was at 487/500 before the change and could not have absorbed the new callbacks. The split itself is a single-line source change (`public class` → `public partial class`) plus a region relocation.
+
+### 2.2 F2 re-verification — `RibbonExplorer.xml` growth is formatter-mandated
+
+`TaskMaster/Ribbon/RibbonExplorer.xml` is 539 lines after the change, up from 519 at the merge-base. The executor reported F2 as **closed as not remediable as specified**. That claim was **independently reproduced in this session** rather than accepted:
+
+| Claim | Independent verification | Result |
+|---|---|---|
+| CSharpier 1.3.0 is the formatter | `csharpier --version` | `1.3.0` — confirmed |
+| `.csharpierignore` does not exclude `*.xml` | Read the file: it excludes `**/evidence/**`, `*.cobertura.xml`, `*.coverage`, `*.coveragexml`, `*.trx`, `*.csproj`, `*.props`, `*.targets` | Confirmed — no general `*.xml` exclusion |
+| No `.csharpierrc`, so the default print width of 100 applies | Searched the repo for `.csharpierrc*` | Confirmed absent |
+| The merge-base single-line form is 78 characters | Measured | 78 — fits |
+| The single-line form carrying `getEnabled` is 116 characters | Measured | 116 — exceeds 100 |
+| CSharpier actually reformats XML and rejects the collapsed form | **Executed** `csharpier check` against a minimal probe document containing the collapsed 116-character `<button>` alongside a 78-character sibling | `Error - Was not formatted`, with CSharpier's expected output expanding **only** the 116-character element to multi-line and leaving the 78-character sibling untouched |
+
+The conclusion holds. The 12 lines the first review characterised as "incidental churn with no functional purpose" are mandated by the format gate that AC22 requires to pass; the requested 527-line target is unreachable while `csharpier check .` must return 0. F2 was correctly escalated rather than forced.
+
+**Disposition of the residual overage.** The 500-line rule in `.claude/rules/general-code-change.md` applies to "production code, test code, or reusable script file". `RibbonExplorer.xml` is a declarative embedded UI resource rather than executable code, the 519-line overage is pre-existing at the merge-base, and the +20 growth decomposes into 8 functionally required `getEnabled` attributes and 12 formatter-mandated expansion lines — none of it discretionary. This is recorded as an accepted exception, consistent with `spec.md` AC25 and Correction Log entry 5, and carried as a Low finding recommending that a resource split be tracked as its own issue. It is not a Blocking finding.
+
+## 3. Language-Specific Code Change Policy Compliance (C#)
+
+**Verdict: PASS.**
+
+| Gate | Command | Result | Source |
+|---|---|---|---|
+| 1. Format | `csharpier check .` | **exit 0 over 1498 files** | **Re-run independently in this session at HEAD** |
+| 2. Lint / analyzers | `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` | exit 0; six warnings, all matching the merge-base baseline | `evidence/qa-gates/msbuild-analyzers.2026-08-08T14-52.md` |
+| 3. Type-check / nullable | `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true` | exit 0 | `evidence/qa-gates/msbuild-nullable.2026-08-08T14-52.md` |
+| 4. Test | `vstest.console.exe` via `Invoke-MSTestWithCoverage.ps1 -Configuration Debug` | 6338/6338 passed, 0 failed, 0 skipped | `evidence/qa-gates/tests-with-coverage.remediation.2026-08-08T14-52.md` |
+
+The format gate was re-executed rather than taken from evidence, and returned exit 0 over exactly the 1498 files the evidence records. The remaining three gates were verified from evidence; they are expensive, mutating (they write `bin/`/`obj/`), and the SKILL directs preference for check-only commands.
+
+**Toolchain-pass currency was verified, not assumed.** MD5 fingerprints of all sixteen touched source paths recorded in `toolchain-clean-pass.2026-08-08T14-58.md` were recomputed against the current tree. Fifteen of sixteen match exactly. The single divergence is `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs`, which is precisely the F1 remediation target — confirming that the 14-58 pass predates F1 and that the authoritative post-remediation pass is the one recorded in `toolchain-clean-pass.2026-08-08T14-52.md`. Both scope-locked paths in that later record were confirmed against the current tree by `git hash-object` (`7d422ef3...` for the test file, `9d8403ee...` for the XML), and both match. The recorded clean pass therefore corresponds to HEAD.
+
+A nullable caveat is recorded and disclosed by the executor rather than concealed: `/t:Build` with only `/p:` changes skips `CoreCompile`, so exit 0 alone does not prove new code is nullable-clean. A forced `/t:Rebuild` verification was performed, surfaced three diagnostics in authored code, and all three were resolved with null-forgiving annotations that carry in-code rationale comments. This matches the known-vacuous-gate behaviour documented for this repository and was handled correctly.
+
+### 3.1 C# design and type-safety
+
+| Requirement | Assessment | Verdict |
+|---|---|---|
+| Strong contracts | Explicit types at all boundaries; XML docs on every public and internal member stating contract and failure mode | PASS |
+| Null safety | Guard clauses throughout; three null-forgiving operators, each with a comment recording why null is a supported value rather than a defect | PASS |
+| Composition over inheritance | No inheritance introduced; the runner composes the gate | PASS |
+| Minimal public surface | All four decision types are `internal`; only one new `public` member exists, and it is required by the Office callback contract | PASS |
+| Resource safety | No disposables introduced | PASS |
+
+### 3.2 Architecture boundaries
+
+Assessed against `.claude/rules/architecture-boundaries.md`.
+
+- Rule 3 (`[ComVisible(true)]` banned in new production code): no new COM-visible type. Grep over added `.cs` lines finds the attribute only inside an XML doc comment explaining that the existing partial already carries it. PASS.
+- Rules 1, 2, 4: the only new Office-typed member is `public bool EngineCommand_GetEnabled(Office.IRibbonControl)` inside the pre-existing COM-visible, coverage-exempt `RibbonViewer`. Grep confirms the four decision types contain zero real `Microsoft.Office.*` references — every match is prose inside a doc comment. PASS.
+- Rule 8 (behavior in host-neutral modules): all readiness, catalog, guard, and refresh-planning logic is host-neutral and would port unchanged to a non-VSTO command surface. PASS.
+
+## 4. Language-Specific Unit Test Policy Compliance (C#)
+
+**Verdict: PASS.**
+
+| Requirement | Evidence | Verdict |
+|---|---|---|
+| MSTest framework | `[TestClass]`/`[TestMethod]`/`[DataTestMethod]` from `Microsoft.VisualStudio.TestTools.UnitTesting` throughout; no xUnit or NUnit introduced | PASS |
+| Moq for mocking | `Mock<IAppItemEngines>`, `Mock<IConditionalEngine<MailItemHelper>>` | PASS |
+| FluentAssertions | Used exclusively; no bare MSTest `Assert` in the new tests | PASS |
+| Arrange–Act–Assert | Every test carries explicit `// Arrange` / `// Act` / `// Assert` markers | PASS |
+| Seam-based mocking of boundaries | The engines container is reached through an injected `Func<IAppItemEngines>`; the notification sink and the invalidation call are injected delegates | PASS |
+| No live COM/Outlook | Confirmed; the tests deliberately avoid `RibbonController.SB`/`Triage`, whose getters install a `WindowsFormsSynchronizationContext` as a side effect — a subtle trap the test design documents and avoids | PASS |
+
+## 5. Test Coverage Detail
+
+45 new tests were added (suite 6293 → 6338).
+
+| Type | Tests | Line coverage | Scenario classes covered |
+|---|---|---|---|
+| `EngineReadinessGate` | 12 | 100% | null accessor, null `InboxEngines`, empty dictionary (the #503 window), key present with non-null engine, key present with null value, null/empty/whitespace name, ordinal case sensitivity, mutation between queries (S1→S2 and `RestartEngineAsync`), `TryGetEngine` both paths, constructor precondition |
+| `EngineGatedCommandRunner` | 13 | 100% | not-ready no-op for both reported exception types, exactly-one notification with control id and engine key, ready path invoked exactly once, await-to-completion, exception propagation, unknown id, null action precondition, `IsCommandEnabled` across three states, both constructor preconditions |
+| `EngineCommandCatalog` | tests for all 8 ids plus negatives | 100% | data-driven mapping, unknown id, null id, `ControlIds` exact membership and duplicate-freedom |
+| `EngineCommandRefreshPlanner` | 2 | 100% | set-equality invalidation (deliberately not order-dependent), null delegate precondition |
+| `RibbonExplorerXmlTests` (#503 additions) | 4 | n/a (asserts resource + reflection) | every catalog id declares the callback (non-vacuous after F1), no other element declares it, schema legality (`button` not `group`/`tab`), Office callback signature pinned by reflection |
+
+Coverage of the state model is complete: S0 through S5 from `spec.md` each have a corresponding named test.
+
+## 6. Test Execution Metrics
+
+| Metric | Baseline (merge-base) | Post-change | Delta |
+|---|---|---|---|
+| Total tests | 6293 | 6338 | +45 |
+| Passed | 6293 | 6338 | +45 |
+| Failed | 0 | 0 | 0 |
+| Skipped | 0 | 0 | 0 |
+| Repo line rate | 85.8477% | 85.8561% | +0.0084 pts |
+| Repo branch rate | 79.2370% | 79.2702% | +0.0332 pts |
+
+## 7. Code Quality Checks
+
+| Check | Result | Verdict |
+|---|---|---|
+| Formatting (CSharpier, re-run at HEAD) | exit 0 over 1498 files | PASS |
+| Analyzer diagnostics | exit 0; warnings match the merge-base baseline exactly, none new | PASS |
+| Nullable / type-check | exit 0; forced-rebuild verification performed and its three findings resolved | PASS |
+| Naming conventions | `PascalCase` types and members, `camelCase` locals and private fields | PASS |
+| XML documentation | Present on every new type and member, with rationale for non-obvious decisions | PASS |
+| Comment quality | Comments explain *why* (deferred lambda rationale, null-forgiving rationale, STA marshalling rationale, ordering-unspecified rationale) rather than restating code | PASS |
+| Dependencies | No new NuGet package, no project reference change | PASS |
+| Suppressions | None added | PASS |
+
+## 8. Gaps and Exceptions
+
+| # | Item | Severity | Disposition |
+|---|---|---|---|
+| G1 | AC19, AC20, AC21 are MANUAL-ONLY and unverified | Pre-merge action | Not a remediation trigger. These require a live Outlook profile and a live mail store; the general unit-test policy prohibits tests depending on external processes, and no Outlook UI-automation harness exists in this repository. They are correctly left unchecked, the maintainer checklist exists at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md` carrying `Status: PENDING MAINTAINER EXECUTION`, and `spec.md` Rollout requires execution before merge. Routing these to an atomic remediation planner would produce a plan no automated executor can run. |
+| G2 | `RibbonExplorer.xml` at 539 lines | Low | Accepted exception. Pre-existing 519-line overage; declarative embedded UI resource, not executable code; +20 growth is 8 required attributes plus 12 formatter-mandated lines, independently verified in §2.2. Recommend tracking a resource split as its own issue. |
+| G3 | Repository carries two inconsistent coverage threshold sets (CLAUDE.md §UT2 says >=80% repo-wide and >=90% new-module; `general-unit-test.md`/`quality-tiers.md` say >=85% line and >=75% branch uniform) | Low | Recorded, not silently resolved. The outcome for #503 is unaffected: the measured figures clear **both** line thresholds and the branch threshold, and the new types clear the stricter 90% floor with a 10-point margin. Maintainer governance item. |
+| G4 | Coverage nondeterminism in untouched packages | Informational | ±12 lines in `UtilitiesCS` between two runs over identical code, on an unchanged denominator. Already promoted as `2026-08-08-wpf-dispatcher-yield-test-order-dependent.md`. Does not affect this branch's verdict. |
+| G5 | Remediation commit subject overstates its content | Low | `00bc47bb` reads "...and restore RibbonExplorer.xml line count", but that commit contains no `RibbonExplorer.xml` change; F2 was escalated, not fixed. The surrounding documentation is accurate; only the commit subject is misleading. Traceability defect. |
+| G6 | PR-context generator misclassification | Low | Corrected in place by this review; see Scope Determination. Recurring generator defect, not a branch defect. |
+
+## 9. Summary of Changes
+
+The initialization race is closed by a per-engine-key readiness signal computed live from the already-published `IAppItemEngines.InboxEngines` member, implemented in four host-neutral `internal` types under `TaskMaster/Ribbon/` that are deliberately **not** `[ExcludeFromCodeCoverage]`. The eight engine-backed `<button>` elements gain `getEnabled="EngineCommand_GetEnabled"`; the eight affected handlers route through a gated runner whose lambda defers the engine dereference; and one refresh call in `ThisAddIn.cs`, explicitly marshalled to the STA, invalidates the eight control ids after initialization.
+
+The design choice that matters most for policy compliance is the refusal to place the readiness signal on `IAppItemEngines`. Because .NET Framework 4.8.1 has no default interface members, any new interface member could only be bodied inside the `[ExcludeFromCodeCoverage]` `AppItemEngines` class and would be entirely uncoverable. Reading an existing interface member instead keeps all decision logic testable **and** yields a zero-line diff on the two files R4 protects. This is the opposite of substituting a coverage attribute for a testability seam.
+
+`AppItemEngines.cs`, `IAppItemEngines.cs`, and `ApplicationGlobals.cs` each take a verified zero-line diff (`git diff --numstat` over those three paths returns empty).
+
+## 10. Compliance Verdict
+
+**PASS.** Zero Blocking findings, zero High findings. Remediation is not triggered: the policy audit contains no meaningful FAIL or PARTIAL result, all four toolchain gates pass, the code review contains no blocker, no automated acceptance criterion is FAIL or PARTIAL, coverage clears every applicable floor, and the coverage artifact is present and current.
+
+Go/no-go: **GO for PR**, conditional on the maintainer executing the AC19–AC21 manual checklist before merge, as `spec.md` Rollout already requires.
+
+## Evidence Location Compliance
+
+All evidence for this feature is written under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/<kind>/`, which is the canonical location required by `.claude/skills/evidence-and-timestamp-conventions/SKILL.md`.
+
+A scan of the branch diff for files under the non-canonical paths `artifacts/baselines/`, `artifacts/qa/`, `artifacts/evidence/`, and `artifacts/coverage/` returned **zero matches**. No `EVIDENCE_LOCATION_OVERRIDE_REJECTED` condition arose in this review. The repository does not contain `scripts/dev_tools/validate_evidence_locations.py`, so the scan was performed directly with `git diff --name-only` against those four prefixes; this is recorded as a substitution of method, not a skipped check.
+
+The canonical coverage artifact at `artifacts/csharp/coverage.xml` is a tool output consumed by the coverage gate, not a feature evidence artifact, and is correctly placed.
+
+## Policy Rule: modified-workflow-needs-green-run
+
+**Does not fire.** The branch diff contains no path matching `.github/workflows/**`, `scripts/benchmarks/**`, or `.github/actions/**`, verified by `git diff --name-only` filtered on those three prefixes. No green-run evidence is therefore required.
+
+## Appendix A: Test Inventory
+
+| Test file | Status | Tests | Target |
+|---|---|---|---|
+| `TaskMaster.Test/Ribbon/EngineReadinessGateTests.cs` | added | 12 | `EngineReadinessGate` |
+| `TaskMaster.Test/Ribbon/EngineGatedCommandRunnerTests.cs` | added | 13 | `EngineGatedCommandRunner` |
+| `TaskMaster.Test/Ribbon/EngineCommandCatalogTests.cs` | added | data-driven, 8 ids plus negatives | `EngineCommandCatalog` |
+| `TaskMaster.Test/Ribbon/EngineCommandRefreshPlannerTests.cs` | added | 2 | `EngineCommandRefreshPlanner` |
+| `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` | modified | 4 added (#503 region) | `RibbonExplorer.xml` wiring and the `RibbonViewer` callback signature |
+
+Total new tests: 45. Suite total: 6338 passed, 0 failed, 0 skipped.
+
+## Appendix B: Toolchain Commands Reference
+
+Commands referenced or executed in this audit:
+
+```
+# Scope and baseline (executed in this session)
+git rev-parse HEAD
+git merge-base HEAD origin/main
+git diff --name-status 003c5715055d7d1933db68a742531332756e30b2..85ff0ee4f0579a3622f2da3a21a6e942b3e4cd12
+git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..85ff0ee4f0579a3622f2da3a21a6e942b3e4cd12
+git diff --numstat <merge-base>..<head> -- TaskMaster/AppGlobals/AppItemEngines.cs UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs TaskMaster/AppGlobals/ApplicationGlobals.cs
+git hash-object TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs TaskMaster/Ribbon/RibbonExplorer.xml
+
+# Format gate (re-executed in this session, check-only)
+csharpier check .            # exit 0, 1498 files
+csharpier --version          # 1.3.0
+
+# F2 formatter-conflict reproduction (executed in this session, scratch probe only)
+csharpier check <scratch>/probe.xml   # reports the 116-char single-line <button> as unformatted
+
+# Toolchain gates verified from recorded evidence (not re-executed)
+msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true
+msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true
+vstest.console.exe <test-assembly-paths> /EnableCodeCoverage   # via scripts/vscode/Invoke-MSTestWithCoverage.ps1
+
+# Coverage verification (artifact inspection only; coverage was not regenerated)
+artifacts/csharp/coverage.xml                                              # canonical, JaCoCo
+<FEATURE>/evidence/baseline/coverage-baseline.jacoco.xml                   # merge-base
+<FEATURE>/evidence/qa-gates/coverage-remediation-final.jacoco.xml          # post-remediation
+```
+
+## Assumptions Recorded
+
+1. The MCP server tools (`resolve_policy_audit_template_asset`, `validate_orchestration_artifacts`) are not available in this session. The canonical major headings were reproduced from the enumeration in `.claude/skills/policy-audit-template-usage/SKILL.md`, which lists them explicitly, and the artifact was validated against the binding repository gate `.claude/hooks/validate-feature-review-coverage.ps1` by direct simulation. This is a substitution of method for an unavailable tool, documented rather than skipped.
+2. The three msbuild/vstest gates were verified from recorded evidence rather than re-executed, because they are expensive and mutating, and because fingerprint comparison established that the recorded pass corresponds to HEAD.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md
new file mode 100644
index 000000000..cfef5edb3
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-inputs.2026-08-08T14-26.md
@@ -0,0 +1,53 @@
+# Remediation Inputs — Cycle 1 (Issue #503)
+
+Timestamp: 2026-08-08T14-26
+Entered by: orchestrator
+Source review: `code-review.2026-08-08T14-15.md`, `policy-audit.2026-08-08T14-15.md`, `feature-audit.2026-08-08T14-15.md`
+
+## Cycle basis
+
+The `feature-review` pass returned **PASS with zero Blocking findings**, so this cycle is **discretionary**, not gate-forced. It is opened because two of the review's Medium findings are defects introduced by this change itself rather than pre-existing conditions, and shipping them would knowingly merge a test that cannot fail and a net-negative edit to a file already over the repository size cap.
+
+Findings that are pre-existing, out of scope, or design questions are **not** in this cycle; they are routed to issues (#504, #505, #506, #507, #508, #509, #510, #511, #512) and must not be touched here.
+
+## Findings to remediate
+
+### F1 — Vacuous assertion in the AC5 ribbon-XML test (Medium, in-scope)
+
+Location: `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, approximately lines 197-206.
+
+The assertion is written as:
+
+```csharp
+...Attribute("getEnabled")?.Value.Should().Be("EngineCommand_GetEnabled");
+```
+
+The null-conditional `?.` short-circuits the entire expression, including the `.Should()` call. When the `getEnabled` attribute is **absent** — precisely the regression this test exists to catch — no assertion executes and the test passes silently.
+
+Required outcome: the assertion must fail when the attribute is missing, when it is present with the wrong value, and when it is present but empty. Do not rely on the sibling set-equality test at approximately line 224 to carry the criterion; that test independently enforces AC5 and must remain, but this test must also be non-vacuous.
+
+Acceptance: introduce a deliberate temporary removal of one `getEnabled` attribute from the embedded ribbon resource, confirm this specific test fails, then restore. Record that fail-then-restore proof as regression-testing evidence. The permanent test suite must not contain the temporary mutation.
+
+### F2 — `RibbonExplorer.xml` grew more than the change required (Medium, in-scope)
+
+The file went from 519 to 539 lines. It was already above the 500-line cap before this change, and `spec.md` AC25 records that pre-existing overage as an accepted exception rather than something this change may worsen.
+
+Only 8 of the 23 added lines are functionally required (one `getEnabled` attribute per engine-backed button). Approximately 12 lines came from reformatting three previously single-line `<button>` elements into multi-line form, which is incidental churn with no functional purpose.
+
+Required outcome: restore the three reformatted `<button>` elements to their original single-line form while retaining their `getEnabled` attribute, so the net line growth reflects only the functional change. The eight `getEnabled` attributes must all remain present and correct.
+
+Acceptance: `RibbonExplorer.xml` line count is at or below 527 (519 + 8). All AC5, AC6, and AC7 ribbon-XML tests still pass. The embedded resource still parses as valid CustomUI.
+
+## Explicitly out of scope for this cycle
+
+- The pre-existing nullable debt and the type-check gate defect (issue #512).
+- The `CS2002` duplicate compile entry in `UtilitiesCS.Test.csproj` (issue #510).
+- The `YieldAsync_WithoutDispatcher_RemainsStrict` flake (issue #508).
+- The residual `engine as SpamBayes` / `.Engine` dereference window (Low; the click guard already makes the reported defect unreachable, and narrowing the readiness contract further is a design change, not a fix).
+- The `??=` lazy initialiser thread-safety observation (Low; the runner is immutable and the reviewer assessed it benign).
+- Any change to `AppItemEngines.cs` or `IAppItemEngines.cs` — AC15 requires these to remain a zero-line diff.
+- AC19, AC20, AC21 — MANUAL-ONLY, must remain unchecked.
+
+## Blocking finding count entering this cycle
+
+0 blocking. This cycle is quality-discretionary; its exit gate is the same reaudit standard.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md
new file mode 100644
index 000000000..3dd1da83e
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/remediation-plan.2026-08-08T14-26.md
@@ -0,0 +1,330 @@
+# Remediation Plan — Cycle 1 (Issue #503)
+
+- **Issue:** #503
+- **Feature folder:** `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`
+- **Branch:** `bug/ribbon-engine-readiness-guard-503`
+- **Merge-base:** `003c5715055d7d1933db68a742531332756e30b2`
+- **Work mode:** `full-bug` (per `spec.md` metadata; `spec.md` is the sole authoritative AC source)
+- **Remediation inputs:** `remediation-inputs.2026-08-08T14-26.md`
+- **Source review:** `code-review.2026-08-08T14-15.md`, `policy-audit.2026-08-08T14-15.md`, `feature-audit.2026-08-08T14-15.md`
+- **Prior implementation plan:** `plan.2026-08-08T11-59.md` (its section 4 scope lock and section 5 design remain authoritative and are not re-litigated here)
+- **Blocking findings entering this cycle:** 0. The cycle is quality-discretionary; its exit gate is the same reaudit standard.
+
+---
+
+## 1. Objective and expected outcome
+
+Remediate exactly the two in-scope findings recorded in `remediation-inputs.2026-08-08T14-26.md`:
+
+- **F1** — the AC5 ribbon-XML assertion in `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` (approximately lines 197-206) short-circuits through a null-conditional operator, so it does not execute when the `getEnabled` attribute is absent. The corrected assertion must fail when the attribute is missing, when it carries the wrong value, and when it is present but empty, and that non-vacuity must be **demonstrated**, not asserted.
+- **F2** — `TaskMaster\Ribbon\RibbonExplorer.xml` grew from 519 to 539 lines while already above the 500-line cap. Three previously single-line `<button>` elements (`TriageSetA`, `TriageSetB`, `TriageSetC`) were reformatted into six-line form. They must be restored to single-line form while retaining their `getEnabled` attribute.
+
+Expected outcome: the corrected AC5 test is proven non-vacuous by a recorded mutate-build-fail-restore cycle; `RibbonExplorer.xml` is at or below **527** lines with all eight `getEnabled="EngineCommand_GetEnabled"` attributes intact; the full C# QC loop passes in a single uninterrupted pass; the change is committed so the reaudit diff observes it. Nothing else in the branch changes.
+
+---
+
+## 2. Path and token conventions
+
+| Token | Value |
+|---|---|
+| `<REPO>` | `C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55` |
+| `<FEATURE>` | `<REPO>\docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503` |
+| `<MERGE_BASE>` | `003c5715055d7d1933db68a742531332756e30b2` |
+| `<TS>` | ISO-8601 capture timestamp in `yyyy-MM-ddTHH-mm` form, substituted at write time |
+| `<CSHARPIER>` | `C:\Users\DanMoisan\.dotnet\tools\csharpier.exe` |
+| `<MSBUILD>` | `C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe` |
+| `<VSTEST>` | `C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe` |
+| `<SCRATCH>` | The executor session scratchpad directory. It is **outside** the repository working tree. Helper scripts written there are throwaway session scripts and are never committed. |
+
+Every evidence artifact carries, at minimum: `Timestamp:`, `Command:`, `EXIT_CODE:`, `Output Summary:`. Test artifacts additionally carry numeric coverage headline values (`line-rate`, `branch-rate`, `lines-covered`, `lines-valid`).
+
+#### 2.1 Evidence locations (non-overridable)
+
+All evidence for this cycle is written under `<FEATURE>\evidence\<kind>\`:
+
+| Kind | Path | Used by |
+|---|---|---|
+| Remediation baseline | `<FEATURE>\evidence\remediation-baseline\` | Phase 0 |
+| Regression testing | `<FEATURE>\evidence\regression-testing\` | Phase 1 |
+| QA gates | `<FEATURE>\evidence\qa-gates\` | Phase 2, Phase 3, Phase 4 |
+| Other | `<FEATURE>\evidence\other\` | intermediate build steps |
+
+`artifacts\baselines\`, `artifacts\baseline\`, `artifacts\qa\`, `artifacts\qa-gates\`, `artifacts\coverage\`, `artifacts\evidence\`, `artifacts\regression-testing\`, and `artifacts\post-change\` are **forbidden** as evidence output paths. No upstream instruction may override this. The single non-evidence exception is `artifacts\csharp\coverage.xml`, which is the canonical **gate** artifact consumed by `.claude\hooks\validate-feature-review-coverage.ps1`; it is gitignored (`.gitignore:57`), local-only, and regenerated rather than committed.
+
+---
+
+## 3. Fixed execution rules (binding on every task in this plan)
+
+1. **Shell.** Every C# toolchain command runs through `pwsh -NoProfile -Command` or `pwsh -NoProfile -File`. Never invoke MSBuild, vstest, csharpier, or nuget through the Bash tool: the Bash tool is Git Bash and rewrites MSBuild `/switch` arguments into paths (`/m` becomes `M:/`, producing `error MSB1008`). This is a hard requirement.
+2. **Absolute tool paths.** `csharpier`, `MSBuild.exe`, and `vstest.console.exe` are not on PATH. Use `<CSHARPIER>`, `<MSBUILD>`, `<VSTEST>` exactly as tabulated. `nuget` is on PATH.
+3. **Restore before building.** `nuget restore TaskMaster.sln` runs unconditionally in Phase 0 (P0-T4) before any build task. It is idempotent; packages are currently restored, so exit 0 is the expected result.
+4. **CSharpier subcommands only.** Formatting gates use `csharpier format <paths>` (mutates on disk) followed by `csharpier check .` returning `EXIT_CODE: 0`. `csharpier pipe-files` is prohibited as a gate: it writes to stdout only, never mutates, and produces a false "stable" result.
+5. **CSharpier scope guard.** `csharpier format` is invoked with the explicit scope-locked path list in section 4 (this cycle: exactly one `.cs` file) and is NEVER invoked repo-wide, and NEVER with `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` in its argument list. A repo-wide `csharpier format .` would reformat any file unformatted at the merge-base and break the AC15 zero-line-diff requirement. The read-only repo-wide `csharpier check .` gate is still run.
+6. **CSharpier does not format XML.** `TaskMaster\Ribbon\RibbonExplorer.xml` is hand-edited. No formatter pass applies to it, and it must never be passed to `csharpier`.
+7. **The embedded-resource rebuild rule.** `RibbonExplorer.xml` is an **embedded resource**. `RibbonExplorerXmlTests` reads it through `assembly.GetManifestResourceStream("TaskMaster.Ribbon.RibbonExplorer.xml")` on the `TaskMaster.dll` copied into `TaskMaster.Test\bin\Debug\`. A change to the `.xml` on disk is invisible to the test until the assembly is rebuilt and re-copied. Every task in this plan that changes the XML and then observes a test result is therefore split into an explicit **edit → rebuild → assert-embedded-content → run-test** sequence, and the assert-embedded-content step is a hard gate. Skipping it produces a false negative in the F1 fail-proof.
+8. **The Phase 1 mutation is temporary and must never be committed.** P1-T5 deliberately removes one `getEnabled` attribute from `RibbonExplorer.xml`. P1-T8 restores it with `git checkout --` and is its own verified task. If execution halts for any reason between P1-T5 and P1-T8, the first action on resume is to run P1-T8. No commit task may execute while the mutation is present; the Phase 4 commit is gated on the P1-T8 restoration artifact.
+9. **Pre-existing failure handling.** The suite is NOT green at baseline. `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` is a pre-existing order-dependent flake tracked as issue **#508** and is explicitly OUT OF SCOPE. A full-suite run passes when the ONLY failures are members of the set recorded in P0-T13. Do not attempt to fix #508. Any failure outside that set is a real regression: fix it and restart Phase 3 from P3-T1.
+10. **No HEAD SHA is pinned as a plan expectation.** P0-T5 records the current HEAD for the audit trail only. All later gates are expressed as tree invariants (clean `git status --porcelain`, no diff on the protected paths, no source path outside the section 4 scope lock), never as equality against a recorded SHA.
+11. **AC19, AC20, AC21 are MANUAL-ONLY and must remain `- [ ]`.** They must NOT be checked off on the strength of unit tests, source inspection, or any automated artifact produced by this cycle. P4-T2 verifies they are still unchecked.
+12. **No acceptance criterion is checked off in this cycle.** Every automated AC in `spec.md` was already checked off by the implementation cycle. This cycle changes no checkbox state anywhere in `spec.md`. The only permitted `spec.md` edit is the append-only subsection in P4-T1.
+13. **Non-AC checkboxes are not acceptance criteria.** The `- [ ] Blocker` / `- [x] High` / `- [ ] Medium` / `- [ ] Low` markers under `## Impact / Severity` in `spec.md` and `issue.md` are severity markers. Do not modify them.
+14. **No `SKIPPED` completion path.** Every command-bearing task in this plan must execute its stated command and record the real result. `EXIT_CODE: SKIPPED` is invalid as a passing outcome for any task in this plan.
+15. **Out-of-scope items must not be touched.** The items enumerated in `remediation-inputs.2026-08-08T14-26.md` under *Explicitly out of scope for this cycle* — the nullable debt and type-check gate defect (#512), the `CS2002` duplicate compile entry (#510), the #508 flake, the residual `engine as SpamBayes` / `.Engine` dereference window, the `??=` lazy-initialiser observation, and any change to `AppItemEngines.cs` or `IAppItemEngines.cs` — are not addressed here. Observing one is reportable, not fixable.
+
+#### 3.1 Helper script A — embedded ribbon resource assertion
+
+Written once to `<SCRATCH>\Assert-EmbeddedRibbon.ps1` in P0-T3 and invoked by P1-T3, P1-T6, P1-T9, and P2-T4. Its verbatim text is recorded in the P0-T3 artifact so the assertion is auditable without the scratchpad. It loads the assembly from a byte array so it never holds a file lock that would block the next rebuild.
+
+```powershell
+param([Parameter(Mandatory = $true)][string]$RepoRoot)
+$ErrorActionPreference = 'Stop'
+$dll = Join-Path $RepoRoot 'TaskMaster.Test\bin\Debug\TaskMaster.dll'
+$asm = [System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($dll))
+$stream = $asm.GetManifestResourceStream('TaskMaster.Ribbon.RibbonExplorer.xml')
+$text = (New-Object System.IO.StreamReader($stream)).ReadToEnd()
+$count = ([regex]::Matches($text, 'getEnabled="EngineCommand_GetEnabled"')).Count
+$single = '<button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />'
+Write-Output ("EMBEDDED_GETENABLED_COUNT={0}" -f $count)
+Write-Output ("EMBEDDED_TRIAGESETA_SINGLELINE={0}" -f $text.Contains($single))
+Write-Output ("EMBEDDED_ASSEMBLY_WRITETIME={0}" -f (Get-Item $dll).LastWriteTimeUtc.ToString('o'))
+```
+
+#### 3.2 Helper script B — Cobertura to first-party JaCoCo projection
+
+Written to `<SCRATCH>\ConvertCoberturaToJacoco.ps1` in P0-T12 and invoked by P0-T12, P3-T7, and P3-T8. Its verbatim text is recorded in the P0-T12 artifact. Required behaviour:
+
+- Read a Cobertura XML file given by `-Source`; write a JaCoCo XML file to `-Destination`.
+- Include only the nine first-party solution packages: `QuickFiler`, `SVGControl`, `Tags`, `TaskMaster`, `TaskTree`, `TaskVisualization`, `ToDoModel`, `UtilitiesCS`, `VBFunctions`. Exclude every other package (vendored `log4net`, `Microsoft.IO.RecyclableMemoryStream`, `Mono.Reflection`, `System.Interactive`, `System.Linq.Async`, and any `*.Test` package).
+- Per included package: `LINE covered` = count of `<line>` elements with `hits` not equal to `0`; `LINE missed` = count with `hits` equal to `0`. `BRANCH covered` = sum of the covered term parsed from each `condition-coverage="NN% (c/t)"` attribute; `BRANCH missed` = sum of `t - c` over the same set.
+- Emit the exact shape of the existing `<FEATURE>\evidence\qa-gates\coverage-final.jacoco.xml`: a `<report name="TaskMaster">` root containing one `<package name="...">` element per included package, each holding a `<counter type="LINE" missed="..." covered="..." />` and a `<counter type="BRANCH" missed="..." covered="..." />`.
+- The output must be under 100 lines. Raw multi-megabyte Cobertura reports are **never** committed to the feature evidence tree.
+
+---
+
+## 4. Scope lock for this cycle
+
+Only the paths below may be created or modified. Any change outside this list is out of scope and must be reported rather than made.
+
+#### 4.1 Source paths that may change
+
+| Path | Change | Current lines | Post-change expectation |
+|---|---|---|---|
+| `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | F1: replace the null-conditional assertion at approximately lines 197-206 | 309 | approximately 313, hard cap 500 |
+| `TaskMaster\Ribbon\RibbonExplorer.xml` | F2: collapse the `TriageSetA` / `TriageSetB` / `TriageSetC` `<button>` elements back to single-line form, retaining `getEnabled` | 539 | **524**, hard gate at or below 527 |
+
+`TaskMaster\Ribbon\RibbonExplorer.xml` is also mutated **temporarily** in P1-T5 and restored in P1-T8. That mutation is not a permitted permanent change.
+
+#### 4.2 Documentation and evidence paths that may change
+
+- `<FEATURE>\remediation-plan.2026-08-08T14-26.md` (this file; checklist state only)
+- `<FEATURE>\spec.md` (append-only: one new subsection under `## Delivery Notes and Deviations`, per P4-T1; zero existing lines changed, zero checkbox state changed)
+- `<FEATURE>\evidence\**` (artifacts written by this plan)
+- `.claude\agent-memory\**` (agent memory updates)
+- Pre-existing uncommitted paths carried in from the review cycle (the `code-review`, `policy-audit`, `feature-audit`, and `remediation-inputs` artifacts at the feature root, and entries under `docs\features\potential\promoted\`). This cycle neither creates nor modifies them; P4-T3's `git add -A` commits them as-is. They are recorded in the P0-T5 porcelain and classified as P3-T11 bucket (c).
+
+#### 4.3 Paths that must take a ZERO-LINE DIFF against `<MERGE_BASE>`
+
+- `TaskMaster\AppGlobals\AppItemEngines.cs`
+- `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs`
+- `TaskMaster\AppGlobals\ApplicationGlobals.cs`
+
+AC15 binds the first two. The third was also a zero-line diff in the implementation cycle and is verified alongside them. P3-T10 and P4-T4 are the verification tasks.
+
+#### 4.4 Gitignored outputs (produced, never committed)
+
+- `coverage\remediation-baseline.cobertura.xml` and `coverage\remediation-final.cobertura.xml` (`.gitignore:144` ignores `coverage/*`)
+- `artifacts\csharp\coverage.xml` (`.gitignore:57` ignores `artifacts/`)
+
+#### 4.5 Scope-locked `.cs` path list for `csharpier format`
+
+```
+TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs
+```
+
+---
+
+## 5. Pinned change specifications (do not re-derive)
+
+#### 5.1 F1 — the corrected assertion
+
+The current body of `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` (`TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`, lines 198-205) is:
+
+```csharp
+elementsById[controlId]
+    .Attribute("getEnabled")
+    ?.Value.Should()
+    .Be(
+        EngineCommandGetEnabledCallback,
+        "control '{0}' is engine-backed and must be disabled until its engine loads",
+        controlId
+    );
+```
+
+It is replaced by the following shape, which binds the attribute first and asserts on it before dereferencing `Value`:
+
+```csharp
+var getEnabled = elementsById[controlId].Attribute("getEnabled");
+getEnabled
+    .Should()
+    .NotBeNull(
+        "control '{0}' is engine-backed and must declare a getEnabled callback",
+        controlId
+    );
+getEnabled!
+    .Value.Should()
+    .Be(
+        EngineCommandGetEnabledCallback,
+        "control '{0}' is engine-backed and must be disabled until its engine loads",
+        controlId
+    );
+```
+
+Why this satisfies all three required failure conditions:
+
+| Condition | Failing assertion |
+|---|---|
+| Attribute absent | `getEnabled.Should().NotBeNull(...)` — `Attribute("getEnabled")` returns `null`, and no `?.` short-circuits the chain |
+| Attribute present with the wrong value | `getEnabled!.Value.Should().Be(...)` — string inequality |
+| Attribute present but empty | `getEnabled!.Value.Should().Be(...)` — `""` is not `"EngineCommand_GetEnabled"` |
+
+The sibling test `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` (line 224) uses `?.Value ==` **inside a LINQ predicate**, where null-means-no-match is the intended semantics. That test is correct, must remain unchanged, and continues to enforce AC5 independently.
+
+The final formatting of the replacement block is whatever `csharpier format` produces in P3-T1. The text above pins semantics, not layout.
+
+#### 5.2 F2 — the three collapsed `<button>` elements
+
+`TaskMaster\Ribbon\RibbonExplorer.xml` lines 448-465 currently hold three six-line elements inside `<group id="TriageGroup" ...>`. They are replaced by exactly three single lines, each indented ten spaces to match the group's children:
+
+```xml
+          <button id="TriageSetA" onAction="TriageSetA_Click" getEnabled="EngineCommand_GetEnabled" label="Set A" />
+          <button id="TriageSetB" onAction="TriageSetB_Click" getEnabled="EngineCommand_GetEnabled" label="Set B" />
+          <button id="TriageSetC" onAction="TriageSetC_Click" getEnabled="EngineCommand_GetEnabled" label="Set C" />
+```
+
+This restores the merge-base single-line form of these three elements (`code-review.2026-08-08T14-15.md` records the removed merge-base line as `<button id="TriageSetA" onAction="TriageSetA_Click" label="Set A" />`) with the one functionally required attribute added. Arithmetic: three elements at six lines each become three elements at one line each, so `git diff --numstat` reports `3` added and `18` deleted, and the file moves from 539 to **524** lines — at or below the 527 gate (519 merge-base + 8 functional attribute lines).
+
+The other five engine-backed buttons (`TrainSpam` 99-105, `TrainHam` 106-112, `TestSpam`, `FilterTriageGroup`, `ClearTriage`) were already multi-line at the merge-base. They are **not** touched. No `menu`, `group`, or `tab` element is touched.
+
+#### 5.3 The F1 mutation used for the fail-proof
+
+P1-T5 deletes exactly one line from `TaskMaster\Ribbon\RibbonExplorer.xml` — line 103, `            getEnabled="EngineCommand_GetEnabled"`, inside the `<button id="TrainSpam" ...>` element that spans lines 99-105. No other byte changes. The result is a file with seven occurrences of `getEnabled="EngineCommand_GetEnabled"` and 538 lines.
+
+Restoration in P1-T8 is `git checkout -- TaskMaster/Ribbon/RibbonExplorer.xml`, which is exact and deterministic because Phase 1 makes no other change to that file and Phase 2 has not yet run.
+
+---
+
+## 6. Explicitly out of scope for this cycle
+
+Do not touch, fix, re-promote, or re-litigate any of the following. Each is already routed to its own issue or was assessed and dismissed by the review.
+
+- Issue **#512** — pre-existing repository-wide nullable debt and the vacuous type-check gate.
+- Issue **#510** — the `CS2002` duplicate `<Compile Include>` entry in `UtilitiesCS.Test.csproj`.
+- Issue **#508** — the `YieldAsync_WithoutDispatcher_RemainsStrict` order-dependent flake.
+- The residual `engine as SpamBayes` / `.Engine` dereference window (Low; the click guard makes the reported defect unreachable, and narrowing the readiness contract is a design change, not a fix).
+- The `??=` lazy-initialiser thread-safety observation in `RibbonController.EngineCommands.cs` (Low; the runner is immutable and the reviewer assessed it benign).
+- Any change to `TaskMaster\AppGlobals\AppItemEngines.cs` or `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` — AC15 requires a zero-line diff on both.
+- AC19, AC20, AC21 — MANUAL-ONLY, must remain unchecked.
+- Issues **#504**, **#505**, **#506**, **#507**, **#509**, **#511** — already promoted out-of-scope findings.
+
+---
+
+## 7. Phased task list
+
+### Phase 0 — Remediation Baseline Capture
+
+- [x] [P0-T1] Read the policy files in the exact order defined by `.claude\skills\policy-compliance-order\SKILL.md`: (1) `<REPO>\CLAUDE.md`, (2) `<REPO>\.claude\rules\general-code-change.md`, (3) `<REPO>\.claude\rules\general-unit-test.md`, (4) `<REPO>\.claude\rules\csharp.md`, then `<REPO>\.claude\rules\architecture-boundaries.md`, `<REPO>\.claude\rules\quality-tiers.md`, and `<REPO>\.claude\rules\tonality.md`. Acceptance: `<FEATURE>\evidence\remediation-baseline\phase0-instructions-read.<TS>.md` exists containing `Timestamp:`, `Policy Order:`, and an explicit ordered list of every file read with its absolute path. Binary outcome: the artifact exists and lists all seven paths in that order.
+- [x] [P0-T2] Read the remediation inputs and supporting context: `<FEATURE>\remediation-inputs.2026-08-08T14-26.md`, `<FEATURE>\spec.md`, `<FEATURE>\plan.2026-08-08T11-59.md`, `<FEATURE>\code-review.2026-08-08T14-15.md`, `<FEATURE>\policy-audit.2026-08-08T14-15.md`, and `<FEATURE>\feature-audit.2026-08-08T14-15.md`. Acceptance: `<FEATURE>\evidence\remediation-baseline\phase0-inputs-read.<TS>.md` exists, records `Timestamp:` and the six absolute paths, states the resolved work mode `full-bug` with `spec.md` named as the sole AC source, and names F1 and F2 as the only two findings in this cycle together with the verbatim out-of-scope list from section 6. Binary outcome: the artifact exists and names exactly two in-scope findings.
+- [x] [P0-T3] Write helper script A to `<SCRATCH>\Assert-EmbeddedRibbon.ps1` with the verbatim body given in section 3.1, and run it once to capture the pre-remediation embedded-resource state. Command: `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`. Acceptance: `<FEATURE>\evidence\remediation-baseline\embedded-ribbon-helper.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, an `Output Summary:` recording `EMBEDDED_GETENABLED_COUNT`, `EMBEDDED_TRIAGESETA_SINGLELINE`, and `EMBEDDED_ASSEMBLY_WRITETIME`, and the verbatim script text so the assertion is reproducible without the scratchpad. Binary outcome: the artifact records `EMBEDDED_GETENABLED_COUNT=8` and `EMBEDDED_TRIAGESETA_SINGLELINE=False`.
+- [x] [P0-T4] Verify tool availability and restore NuGet packages. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Test-Path 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe'; Test-Path 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe'; Test-Path 'TaskMaster.runsettings'; nuget restore TaskMaster.sln"`. Acceptance: `<FEATURE>\evidence\remediation-baseline\toolchain-and-restore.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording one `True`/`False` per probed path plus the restore result. Binary outcome: all four `Test-Path` probes report `True` and the restore exits 0.
+- [x] [P0-T5] Record git state for the audit trail. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git rev-parse HEAD; git rev-parse --abbrev-ref HEAD; git status --porcelain"`. Acceptance: `<FEATURE>\evidence\remediation-baseline\git-state.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the current HEAD SHA, the branch name `bug/ribbon-engine-readiness-guard-503`, the merge-base `003c5715055d7d1933db68a742531332756e30b2`, and the verbatim `git status --porcelain` output. The recorded HEAD is an audit record only and is never used as a later equality gate. Binary outcome: no `.cs`, `.csproj`, `.xml`, or `.sln` path appears in the porcelain output.
+- [x] [P0-T6] Record the current line counts and `getEnabled` occurrence counts of the two files this cycle will touch. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; 'TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs','TaskMaster\Ribbon\RibbonExplorer.xml' | ForEach-Object { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines }; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=' -AllMatches | Measure-Object).Count"`. Acceptance: `<FEATURE>\evidence\remediation-baseline\file-line-counts.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording both line counts and the occurrence count. Binary outcome: the artifact records `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs=309`, `TaskMaster\Ribbon\RibbonExplorer.xml=539`, and 8 `getEnabled` occurrences; any deviation is recorded verbatim and treated as a finding rather than overwritten.
+- [x] [P0-T7] Capture the verbatim pre-remediation text of both change sites. Acceptance: `<FEATURE>\evidence\remediation-baseline\change-site-text.<TS>.md` exists with `Timestamp:` and two fenced blocks: the current body of `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` from `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` lines 188-206 quoted verbatim with line numbers, and the current `TriageSetA` / `TriageSetB` / `TriageSetC` `<button>` elements from `TaskMaster\Ribbon\RibbonExplorer.xml` lines 448-465 quoted verbatim with line numbers. Binary outcome: the artifact contains both blocks and the test block visibly contains the `?.Value.Should()` sequence that F1 removes.
+- [x] [P0-T8] Capture the CSharpier state repo-wide, read-only. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\remediation-baseline\csharpier-check.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` that, when the exit code is non-zero, lists verbatim every file CSharpier reports as unformatted. This set is the comparison basis for P3-T2. Do not run `csharpier format` in this task. Binary outcome: the measured exit code and unformatted set are recorded verbatim.
+- [x] [P0-T9] Capture the analyzer build baseline. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\remediation-baseline\msbuild-analyzers.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the error count and the warning count. Binary outcome: `EXIT_CODE: 0`.
+- [x] [P0-T10] Capture the nullable/type-check build baseline. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\remediation-baseline\msbuild-nullable.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` that also records the known limitation from `code-review.2026-08-08T14-15.md` — MSBuild skips `CoreCompile` when only `/p:` values change, so exit 0 alone does not prove the tree is nullable-clean, and that limitation is issue **#512**, out of scope here. Binary outcome: `EXIT_CODE: 0`.
+- [x] [P0-T11] Capture the full-suite test and coverage baseline for this cycle. Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput coverage\remediation-baseline.cobertura.xml` run from `<REPO>`. Acceptance: `coverage\remediation-baseline.cobertura.xml` exists (gitignored, never committed) and `<FEATURE>\evidence\remediation-baseline\tests-with-coverage.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` containing total/passed/failed/skipped test counts and the numeric root `<coverage>` attributes `line-rate`, `branch-rate`, `lines-covered`, and `lines-valid` read from the emitted XML. Binary outcome: zero skipped tests, and the failure set is recorded verbatim by fully-qualified name for use by P0-T13.
+- [x] [P0-T12] Write helper script B to `<SCRATCH>\ConvertCoberturaToJacoco.ps1` per section 3.2 and project the P0-T11 report into a compact first-party summary. Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-baseline.cobertura.xml -Destination docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\remediation-baseline\coverage-remediation-baseline.jacoco.xml`. Acceptance: `<FEATURE>\evidence\remediation-baseline\coverage-remediation-baseline.jacoco.xml` exists and `<FEATURE>\evidence\remediation-baseline\coverage-projection.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, the verbatim script text, and an `Output Summary:` recording the aggregate first-party `LINE covered`/`LINE missed`/`BRANCH covered`/`BRANCH missed` totals and the derived LINE and BRANCH percentages. Binary outcome: the `.jacoco.xml` file exists, is under 100 lines, contains exactly nine `<package>` elements, and no raw `.cobertura.xml` file is written anywhere under `<FEATURE>\evidence\`.
+- [x] [P0-T13] Record the pre-existing failing test set and the pass rule that depends on it. Acceptance: `<FEATURE>\evidence\remediation-baseline\preexisting-failures.<TS>.md` exists with `Timestamp:`, names by fully-qualified name every failing test observed in P0-T11, explicitly names `UtilitiesCS.Test.OutlookObjects.Folder.WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` as a pre-existing order-dependent flake tracked by issue **#508** and out of scope, and states the rule verbatim: a Phase 3 test run passes when the only failures are members of this recorded set; any test not in this set that fails is a real regression that restarts Phase 3 at P3-T1; issue #508 must not be fixed in this cycle. Binary outcome: the artifact exists and enumerates the set explicitly, including the empty case if there were no failures.
+
+---
+
+### Phase 1 — F1 Non-Vacuous Assertion and Recorded Fail-Proof
+
+This phase deliberately mutates `TaskMaster\Ribbon\RibbonExplorer.xml` between P1-T5 and P1-T8 to prove the corrected assertion can fail. Rule 8 of section 3 governs that window. Rule 7 governs the rebuild ordering: the embedded resource is only observable by the test after a rebuild, so every mutation is followed by a rebuild and an embedded-content assertion **before** any test is run.
+
+- [x] [P1-T1] Replace the null-conditional assertion in `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` inside `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` with the two-step shape pinned in section 5.1: bind `elementsById[controlId].Attribute("getEnabled")` to a local, assert `NotBeNull` on it with a `because` reason naming the control id, then assert `Value.Should().Be(EngineCommandGetEnabledCallback, ...)`. Binary outcome: the method body contains zero occurrences of `?.` , contains both `.Should().NotBeNull(` and `.Value.Should()` `.Be(`, the `ContainKey` assertion above it is unchanged, `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` at approximately line 224 is byte-identical to its pre-change text, no other member of the file changes, and the file remains at or under 500 lines.
+- [x] [P1-T2] Record the three-condition non-vacuity argument by source inspection. Acceptance: `<FEATURE>\evidence\regression-testing\f1-assertion-shape.<TS>.md` exists with `Timestamp:`, `Command:` naming the inspection performed, `EXIT_CODE: 0`, the post-change method body quoted verbatim, and an `Output Summary:` mapping each of the three required failure conditions from `remediation-inputs.2026-08-08T14-26.md` (attribute missing, attribute present with the wrong value, attribute present but empty) to the specific assertion line that fails for it, per the table in section 5.1. Binary outcome: all three conditions are mapped to a named assertion line.
+- [x] [P1-T3] Rebuild the solution so the corrected test compiles and the **unmutated** ribbon resource is embedded, then assert the embedded content. Commands, in order: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""` then `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`. Acceptance: `<FEATURE>\evidence\other\phase1-build-premutation.<TS>.md` exists with `Timestamp:`, both `Command:` lines, `EXIT_CODE: 0` for each, and an `Output Summary:` recording the helper output. Binary outcome: the build exits 0 and the helper reports `EMBEDDED_GETENABLED_COUNT=8`.
+- [x] [P1-T4] Run the scoped ribbon-XML test class against the unmutated resource to establish the corrected assertion is green before the mutation. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe' 'TaskMaster.Test\bin\Debug\TaskMaster.Test.dll' /InIsolation /Settings:TaskMaster.runsettings /TestCaseFilter:'FullyQualifiedName~TaskMaster.Test.Ribbon.RibbonExplorerXmlTests'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\regression-testing\f1-green-before-mutation.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` naming `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` as Passed with total/passed/failed/skipped counts. Binary outcome: `EXIT_CODE: 0` with zero failed and zero skipped.
+- [x] [P1-T5] Apply the temporary mutation: delete exactly line 103 of `TaskMaster\Ribbon\RibbonExplorer.xml` — the `getEnabled="EngineCommand_GetEnabled"` attribute line inside the `<button id="TrainSpam" ...>` element — and change nothing else. Acceptance: `<FEATURE>\evidence\regression-testing\f1-mutation-applied.<TS>.md` exists with `Timestamp:`, `Command:` recording the edit and the verification, `EXIT_CODE: 0`, and an `Output Summary:` recording the file's `getEnabled="EngineCommand_GetEnabled"` occurrence count, its line count, and the `git diff --numstat -- TaskMaster/Ribbon/RibbonExplorer.xml` output. Binary outcome: the file contains exactly 7 occurrences, is 538 lines, and `git diff --numstat` reports `0` added and `1` deleted for that path.
+- [x] [P1-T6] Rebuild so the **mutated** resource is re-embedded, then assert the embedded content. This task is the gate that prevents a false-negative fail-proof: without it the test would read a stale assembly still carrying eight attributes. Commands, in order: the same `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'` invocation as P1-T3, then `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`. If the helper still reports 8, force the resource refresh with `msbuild TaskMaster\TaskMaster.csproj /t:Rebuild /p:Configuration=Debug /p:Platform='Any CPU'` followed by the solution build, and record both invocations in the artifact. Acceptance: `<FEATURE>\evidence\regression-testing\f1-mutated-assembly.<TS>.md` exists with `Timestamp:`, every `Command:` executed, `EXIT_CODE: 0` for the final build, and an `Output Summary:` recording the helper output and the `EMBEDDED_ASSEMBLY_WRITETIME` value. Binary outcome: the helper reports `EMBEDDED_GETENABLED_COUNT=7`.
+- [x] [P1-T7] [expect-fail] Run the scoped ribbon-XML test class against the mutated resource and record the failure. Command: identical to P1-T4. Acceptance: `<FEATURE>\evidence\regression-testing\f1-fail-proof.<TS>.md` exists with `Timestamp:`, `Command:`, a **non-zero** `EXIT_CODE:`, and an `Output Summary:` quoting the verbatim failure message for `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback`, recording total/passed/failed counts, listing every other test that failed as a consequence of the same mutation, and cross-referencing `<FEATURE>\evidence\regression-testing\f1-mutated-assembly.<TS>.md` as proof that the assembly under test carried the mutation. Binary outcome: `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` is reported **Failed**. If it is reported Passed, the fail-proof has not been demonstrated: return to P1-T6 and resolve the stale-assembly cause before proceeding.
+- [x] [P1-T8] Restore the mutation. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git checkout -- TaskMaster/Ribbon/RibbonExplorer.xml; git status --porcelain -- TaskMaster/Ribbon/RibbonExplorer.xml; (Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' | Measure-Object -Line).Lines; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=\"EngineCommand_GetEnabled\"' -AllMatches | Measure-Object).Count; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\regression-testing\f1-mutation-restored.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the empty porcelain output, the line count, and the occurrence count. Binary outcome: `git status --porcelain -- TaskMaster/Ribbon/RibbonExplorer.xml` is empty, the file is 539 lines, and it contains exactly 8 occurrences. The permanent tree retains no part of the mutation.
+- [x] [P1-T9] Rebuild so the restored resource is re-embedded, then assert the embedded content. Commands, in order: the same solution build as P1-T3, then `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`. Acceptance: `<FEATURE>\evidence\other\phase1-build-postrestore.<TS>.md` exists with `Timestamp:`, both `Command:` lines, `EXIT_CODE: 0` for each, and an `Output Summary:` recording the helper output. Binary outcome: the helper reports `EMBEDDED_GETENABLED_COUNT=8`.
+- [x] [P1-T10] Re-run the scoped ribbon-XML test class and record the pass-after state. Command: identical to P1-T4. Acceptance: `<FEATURE>\evidence\regression-testing\f1-pass-after-restore.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` naming `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` as Passed, recording total/passed/failed/skipped, and cross-referencing the `f1-fail-proof.<TS>.md` path so the fail-then-pass pair is traceable from one artifact. Binary outcome: `EXIT_CODE: 0` with zero failed and zero skipped.
+
+---
+
+### Phase 2 — F2 Ribbon XML Line Restoration
+
+- [ ] [P2-T1] Replace the six-line `TriageSetA`, `TriageSetB`, and `TriageSetC` `<button>` elements in `TaskMaster\Ribbon\RibbonExplorer.xml` (currently lines 448-465) with the three single lines pinned verbatim in section 5.2, each indented ten spaces. No other element, attribute, or line in the file changes; in particular no `menu`, `group`, or `tab` element is modified and the five already-multi-line engine-backed buttons are untouched. Binary outcome: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat -- TaskMaster/Ribbon/RibbonExplorer.xml"` reports exactly `3` added and `18` deleted for that path.
+- [ ] [P2-T2] Verify the F2 size and attribute gates. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; (Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' | Measure-Object -Line).Lines; (Select-String -Path 'TaskMaster\Ribbon\RibbonExplorer.xml' -Pattern 'getEnabled=\"EngineCommand_GetEnabled\"' -AllMatches | Measure-Object).Count; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\f2-xml-line-count.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the measured line count against the merge-base 519, the post-implementation 539, and the 527 gate, plus the measured attribute count. Binary outcome: the file is **at or below 527 lines** (expected 524) and contains exactly **8** occurrences of `getEnabled="EngineCommand_GetEnabled"`.
+- [ ] [P2-T3] Verify the file is still well-formed CustomUI. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; [xml]$d = Get-Content 'TaskMaster\Ribbon\RibbonExplorer.xml' -Raw; $d.DocumentElement.LocalName; $d.DocumentElement.NamespaceURI; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\f2-xml-wellformed.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the parsed root local name and namespace URI. Binary outcome: the document parses without error, the root local name is `customUI`, and the namespace URI is `http://schemas.microsoft.com/office/2009/07/customui`.
+- [ ] [P2-T4] Rebuild so the collapsed resource is re-embedded, then assert the embedded content reflects the single-line form. Commands, in order: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""` then `pwsh -NoProfile -File <SCRATCH>\Assert-EmbeddedRibbon.ps1 -RepoRoot 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'`. Acceptance: `<FEATURE>\evidence\other\phase2-build.<TS>.md` exists with `Timestamp:`, both `Command:` lines, `EXIT_CODE: 0` for each, and an `Output Summary:` recording the helper output. Binary outcome: the helper reports `EMBEDDED_GETENABLED_COUNT=8` **and** `EMBEDDED_TRIAGESETA_SINGLELINE=True`.
+- [ ] [P2-T5] Run the scoped ribbon-XML test class against the collapsed resource. Command: identical to P1-T4. Acceptance: `<FEATURE>\evidence\regression-testing\f2-ribbon-xml-tests.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` naming `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` (AC5), `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` (AC6), `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` (AC7), and `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` (AC8) as Passed, with total/passed/failed/skipped counts. Binary outcome: `EXIT_CODE: 0` with zero failed and zero skipped.
+
+---
+
+### Phase 3 — Full QC Loop
+
+Loop semantics: the order is format, then the read-only repo-wide format check, then the post-format size audit, then lint (analyzer build), then type-check (nullable build), then test-with-coverage, then the coverage and structural gates. This phase is **unconditional**: every task executes its stated command and records the real result. `EXIT_CODE: SKIPPED` is not a valid completion for any task in this phase. If any task fails, or if any task changes a `.cs`, `.csproj`, `.xml`, or `.sln` file on disk, fix the cause and restart the phase from P3-T1. Writing this phase's own evidence artifacts under `<FEATURE>\evidence\` is not an intervening file change. The phase is complete only when P3-T1 through P3-T12 all succeed within a single uninterrupted pass.
+
+- [x] [P3-T1] Format the scope-locked C# file. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' format TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\csharpier-format.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` stating whether CSharpier rewrote the file. `csharpier pipe-files` is prohibited. `TaskMaster\AppGlobals\AppItemEngines.cs`, `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs`, and `TaskMaster\Ribbon\RibbonExplorer.xml` must not appear in the argument list, and the command must never be invoked repo-wide. Binary outcome: `EXIT_CODE: 0`.
+- [x] [P3-T2] Verify formatting repo-wide, read-only. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Users\DanMoisan\.dotnet\tools\csharpier.exe' check .; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\csharpier-check.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` comparing the reported unformatted set against the P0-T8 baseline set. Binary outcome: either `EXIT_CODE: 0`, or a non-zero exit whose unformatted set is exactly the P0-T8 set and does not contain `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`. If the scope-locked file is reported unformatted, restart the phase at P3-T1.
+- [x] [P3-T3] Run the post-format file-size audit over every path in the working-tree change set. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git status --porcelain | ForEach-Object { $_.Substring(3) } | ForEach-Object { if (Test-Path $_) { '{0}={1}' -f $_, (Get-Content $_ | Measure-Object -Line).Lines } }"`. Acceptance: `<FEATURE>\evidence\qa-gates\file-size-audit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` listing every changed path with its post-format line count, recording that Markdown documentation and evidence files under `docs/features/` and `.claude/agent-memory/` are exempt from the 500-line cap per `.claude/rules/general-code-change.md`, and recording `TaskMaster\Ribbon\RibbonExplorer.xml` explicitly against both the 519-line merge-base figure accepted by AC25 and the 527-line gate for this cycle. Binary outcome: every `.cs` path is at or under 500 lines, and `TaskMaster\Ribbon\RibbonExplorer.xml` is at or under 527 lines and strictly below its 539-line pre-remediation count.
+- [x] [P3-T4] Run the analyzer gate. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\msbuild-analyzers.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording zero errors and no new analyzer diagnostics relative to the P0-T9 baseline. Binary outcome: `EXIT_CODE: 0` with no diagnostic absent from the P0-T9 baseline.
+- [x] [P3-T5] Run the nullable/type-check gate. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; & 'C:\Program Files\Microsoft Visual Studio\18\Community\MSBuild\Current\Bin\MSBuild.exe' TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform='Any CPU' /p:Nullable=enable /p:TreatWarningsAsErrors=true; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\msbuild-nullable.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` that also restates the P0-T10 limitation and its routing to issue **#512**, which is out of scope for this cycle. Binary outcome: `EXIT_CODE: 0`.
+- [x] [P3-T6] Run the full test suite with coverage. Command: `pwsh -NoProfile -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug -CoverageOutput coverage\remediation-final.cobertura.xml` run from `<REPO>`. Acceptance: `coverage\remediation-final.cobertura.xml` exists (gitignored, never committed) and `<FEATURE>\evidence\qa-gates\tests-with-coverage.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE:`, and an `Output Summary:` containing total/passed/failed/skipped counts, the numeric root `<coverage>` attributes `line-rate`, `branch-rate`, `lines-covered`, and `lines-valid`, and an explicit reconciliation of every failure against the P0-T13 pre-existing set. Binary outcome: zero skipped tests, and either zero failed tests or a failure set that is a subset of the P0-T13 set. Any failure outside that set is a regression: fix it and restart the phase at P3-T1.
+- [x] [P3-T7] Project the P3-T6 report into a compact committed summary using helper script B. Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-final.cobertura.xml -Destination docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\evidence\qa-gates\coverage-remediation-final.jacoco.xml`. Acceptance: `<FEATURE>\evidence\qa-gates\coverage-remediation-final.jacoco.xml` exists and `<FEATURE>\evidence\qa-gates\coverage-projection.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the aggregate first-party `LINE covered`/`LINE missed`/`BRANCH covered`/`BRANCH missed` totals and the derived LINE and BRANCH percentages. Binary outcome: the `.jacoco.xml` file exists, is under 100 lines, contains exactly nine `<package>` elements, and no raw `.cobertura.xml` file is written anywhere under `<FEATURE>\evidence\`.
+- [x] [P3-T8] Regenerate the canonical gate artifact. Command: `pwsh -NoProfile -File <SCRATCH>\ConvertCoberturaToJacoco.ps1 -Source coverage\remediation-final.cobertura.xml -Destination artifacts\csharp\coverage.xml`. Acceptance: `<FEATURE>\evidence\qa-gates\coverage-gate-artifact.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the LINE and BRANCH percentages that `.claude\hooks\validate-feature-review-coverage.ps1` reads from the generated file, together with the note that `artifacts/` is gitignored (`.gitignore:57`) so this file is local-only and regenerated rather than committed. Binary outcome: `artifacts\csharp\coverage.xml` exists in JaCoCo format and its derived repo-wide LINE percentage is at or above 85 and BRANCH at or above 75.
+- [x] [P3-T9] Produce the coverage comparison for this cycle. Acceptance: `<FEATURE>\evidence\qa-gates\coverage-comparison.<TS>.md` exists with `Timestamp:` and a table comparing three points on the same first-party nine-package denominator: the implementation-cycle post-change figures from `<FEATURE>\evidence\qa-gates\coverage-final.jacoco.xml` (LINE covered 95473 / missed 15734; BRANCH covered 22131 / missed 5795), the P0-T12 remediation baseline, and the P3-T7 remediation final. The artifact must state that this cycle changes one test file and one embedded XML resource and therefore is expected to leave production line coverage unchanged, must record the `TaskMaster` package `LINE` counter at all three points, must restate the denominator note from `<FEATURE>\evidence\qa-gates\coverage-artifact-substitution.2026-08-08T17-40.md` (vendored packages excluded by `coverage.config`; the unfiltered root figure is not the policy denominator), and must record the documented threshold conflict (CLAUDE.md 80 percent repo-wide / 90 percent new code versus `.claude/rules/general-unit-test.md` 85 percent line / 75 percent branch) as a known unresolved policy conflict rather than silently selecting one number. Binary outcome: the derived first-party LINE and BRANCH percentages at P3-T7 are greater than or equal to the P0-T12 values to two decimal places, and any shortfall is recorded with its cause rather than reported as a pass.
+- [x] [P3-T10] Verify the AC15 zero-line diff across the working tree, not only across HEAD. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2 -- TaskMaster/AppGlobals/AppItemEngines.cs UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs TaskMaster/AppGlobals/ApplicationGlobals.cs; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. This form compares the working tree against the merge-base, so it catches an uncommitted edit that a `<MERGE_BASE>..HEAD` diff would miss. Acceptance: `<FEATURE>\evidence\qa-gates\zero-line-diff.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` quoting the command output verbatim. Binary outcome: the output is **empty** — none of the three protected paths differs from the merge-base.
+- [x] [P3-T11] Verify the source scope lock. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git status --porcelain"`. Acceptance: `<FEATURE>\evidence\qa-gates\scope-lock-audit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` quoting the porcelain output verbatim and classifying every entry into exactly one of four buckets: **(a)** a section 4.1 source path; **(b)** a section 4.2 documentation or evidence path, which includes any file or collapsed directory entry under `<FEATURE>\evidence\` regardless of extension; **(c)** a pre-existing uncommitted path carried in from the review cycle, which this cycle neither created nor modified, verified by its presence in the P0-T5 `git-state.<TS>.md` porcelain; or **(d)** a violation. Binary outcome: **outside `<FEATURE>\evidence\`** the only `.cs`, `.csproj`, `.xml`, or `.sln` paths present are `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` and `TaskMaster/Ribbon/RibbonExplorer.xml`; every bucket (c) entry also appears in the P0-T5 porcelain; bucket (d) is empty; and no `coverage/` or `artifacts/` path appears (both are gitignored).
+- [x] [P3-T12] Record the single uninterrupted clean toolchain pass. Acceptance: `<FEATURE>\evidence\qa-gates\toolchain-clean-pass.<TS>.md` exists with `Timestamp:` and, in order, the artifact path plus `EXIT_CODE:` for P3-T1, P3-T2, P3-T4, P3-T5, and P3-T6, together with an explicit statement that all five ran in one pass with no intervening `.cs`, `.csproj`, `.xml`, or `.sln` change and no restart. Binary outcome: the recorded sequence contains no restart.
+
+---
+
+### Phase 4 — Commit and Post-Commit Verification
+
+- [x] [P4-T1] Append one new subsection to `<FEATURE>\spec.md` at the end of `## Delivery Notes and Deviations`, titled `### Remediation Cycle 1 — 2026-08-08T14-26`, recording: F1 (the AC5 assertion made non-vacuous, with the fail-proof evidence path `evidence/regression-testing/f1-fail-proof.<TS>.md` and the restoration evidence path `evidence/regression-testing/f1-mutation-restored.<TS>.md`); F2 (the three `TriageSet*` buttons restored to single-line form, moving `RibbonExplorer.xml` from 539 to its measured post-change line count, which supersedes the 539 figure while leaving the AC25 pre-existing 519-line exception unchanged in kind); and that no acceptance criterion changed state in this cycle. Binary outcome: exactly one new subsection is appended, `git diff -- docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md` shows zero deleted lines, and no `- [ ]` or `- [x]` marker anywhere in the file changes state.
+- [x] [P4-T2] Verify AC19, AC20, and AC21 remain unchecked in `<FEATURE>\spec.md`. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; Select-String -Path 'docs\features\active\2026-08-08-ribbon-engine-readiness-guard-503\spec.md' -Pattern '\*\*AC19|\*\*AC20|\*\*AC21'; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\manual-only-unchecked.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` quoting the three criterion lines verbatim. Binary outcome: all three lines still begin `- [ ] **AC19`, `- [ ] **AC20`, and `- [ ] **AC21`.
+- [x] [P4-T3] Commit the remediation so the reaudit diff observes it. Command: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git add -A; git commit -m 'fix(#503): make the AC5 ribbon-XML assertion non-vacuous and restore RibbonExplorer.xml line count'; git rev-parse HEAD; git status --porcelain; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. This task may execute only after the P1-T8 restoration artifact records an empty porcelain for `TaskMaster/Ribbon/RibbonExplorer.xml`; committing while the P1-T5 mutation is present is a hard failure. Acceptance: `<FEATURE>\evidence\qa-gates\remediation-commit.<TS>.md` exists with `Timestamp:`, `Command:`, `EXIT_CODE: 0`, and an `Output Summary:` recording the new HEAD SHA and the post-commit porcelain output. Binary outcome: `git status --porcelain` is empty after the commit.
+- [x] [P4-T4] Re-verify the protected-path and scope invariants against the committed tree. Two commands, in order. **First**, the protected-path check, path-scoped so the enclosing branch diff cannot mask it: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git diff --numstat 003c5715055d7d1933db68a742531332756e30b2..HEAD -- TaskMaster/AppGlobals/AppItemEngines.cs UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs TaskMaster/AppGlobals/ApplicationGlobals.cs; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. **Second**, the scope check over the **remediation commit's own diff** — not the whole-branch diff, which necessarily contains every implementation-cycle path and would make an unscoped gate unsatisfiable: `pwsh -NoProfile -Command "Set-Location 'C:\Users\DanMoisan\repos\TaskMaster-wt\2026-08-08T11-55'; git show --numstat --format= HEAD; Write-Host \"EXIT_CODE=$LASTEXITCODE\""`. Acceptance: `<FEATURE>\evidence\qa-gates\zero-line-diff-postcommit.<TS>.md` exists with `Timestamp:`, both `Command:` lines, `EXIT_CODE: 0` for each, and an `Output Summary:` containing both outputs verbatim, an explicit statement that `TaskMaster/AppGlobals/AppItemEngines.cs`, `UtilitiesCS/Interfaces/IGlobals/IAppItemEngines.cs`, and `TaskMaster/AppGlobals/ApplicationGlobals.cs` are absent from the first output, and a classification of every path in the second output into the four P3-T11 buckets. Binary outcome: the first command's output is **empty**; and in the second command's output, outside `<FEATURE>\evidence\` the only `.cs`, `.csproj`, `.xml`, or `.sln` paths are `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` and `TaskMaster/Ribbon/RibbonExplorer.xml`, with no bucket (d) entry.
+- [x] [P4-T5] Record the reaudit handoff. Acceptance: `<FEATURE>\evidence\qa-gates\remediation-reaudit-handoff.<TS>.md` exists with `Timestamp:`, the post-commit HEAD SHA from P4-T3, and one row per finding: **F1** marked resolved with pointers to `evidence/regression-testing/f1-assertion-shape.<TS>.md`, `evidence/regression-testing/f1-fail-proof.<TS>.md`, `evidence/regression-testing/f1-mutation-restored.<TS>.md`, and `evidence/regression-testing/f1-pass-after-restore.<TS>.md`; and **F2** marked resolved with pointers to `evidence/qa-gates/f2-xml-line-count.<TS>.md`, `evidence/qa-gates/f2-xml-wellformed.<TS>.md`, and `evidence/regression-testing/f2-ribbon-xml-tests.<TS>.md`. The artifact must also state that AC19, AC20, and AC21 remain unchecked, that no acceptance criterion changed state in this cycle, and that the out-of-scope items in section 6 were not touched. Binary outcome: both findings are marked resolved with at least one evidence pointer each, and the blocking-finding count entering the reaudit is recorded as 0.
+
+---
+
+## 8. Traceability
+
+| Finding | Source | Phase | Verifying tasks | Binary gate |
+|---|---|---|---|---|
+| F1 — vacuous AC5 assertion | `remediation-inputs.2026-08-08T14-26.md` §F1; `code-review.2026-08-08T14-15.md` row 1 | 1 | P1-T1, P1-T2, P1-T7, P1-T8, P1-T10 | The corrected test is reported **Failed** with the resource mutated (P1-T7) and **Passed** with it restored (P1-T10); the permanent tree retains no mutation (P1-T8) |
+| F2 — `RibbonExplorer.xml` line growth | `remediation-inputs.2026-08-08T14-26.md` §F2; `code-review.2026-08-08T14-15.md` row 2 | 2 | P2-T1, P2-T2, P2-T3, P2-T4, P2-T5 | File at or below **527** lines with exactly **8** `getEnabled="EngineCommand_GetEnabled"` attributes, well-formed CustomUI, AC5/AC6/AC7/AC8 tests passing |
+| AC15 zero-line diff preserved | `spec.md` AC15; `remediation-inputs.2026-08-08T14-26.md` out-of-scope list | 3, 4 | P3-T10, P4-T4 | `git diff --numstat` against the merge-base is empty for all three protected paths |
+| AC19/AC20/AC21 remain MANUAL-ONLY | `spec.md`; section 3 rule 11 | 4 | P4-T2 | All three lines still begin `- [ ]` |
+| Full QC loop | CLAUDE.md CUT3; `.claude/rules/csharp.md` | 3 | P3-T1, P3-T2, P3-T4, P3-T5, P3-T6, P3-T12 | Five gate commands pass in one uninterrupted pass with no restart |
+| Coverage evidence | `.claude/skills/atomic-plan-contract` coverage contract | 0, 3 | P0-T11, P0-T12, P3-T6, P3-T7, P3-T8, P3-T9 | Numeric baseline and post-change coverage recorded; compact JaCoCo summaries committed; canonical gate artifact regenerated |
+
+---
+
+## 9. Recorded decisions
+
+1. **The fail-proof mutates the resource, not the test.** F1's acceptance in `remediation-inputs.2026-08-08T14-26.md` requires a deliberate temporary removal of one `getEnabled` attribute from the embedded ribbon resource. Mutating the resource, rather than writing a second test over a synthetic in-memory XML fragment, is what proves the assertion is non-vacuous **against the real embedded artifact the test actually reads**. A synthetic-document test would prove the FluentAssertions shape without proving the resource-loading path.
+2. **The rebuild step is a plan-level gate, not an implementation detail.** Because the XML is an embedded resource, an edit-then-run sequence would read a stale assembly and report a false Pass, silently converting the fail-proof into a second vacuous check. P1-T6 asserts the embedded byte content **before** the failing run is attempted, which is the only way to distinguish "the assertion cannot fail" from "the assembly was stale". P1-T6 also carries an explicit `/t:Rebuild` fallback for the case where MSBuild's incremental resource check does not pick up the edit.
+3. **`git checkout --` is the restoration mechanism.** It is exact and deterministic because Phase 1 makes no other change to `RibbonExplorer.xml` and Phase 2 has not yet run. A hand re-insertion of the deleted line would be a second opportunity to introduce a whitespace or ordering difference.
+4. **`TrainSpam` is the mutation target.** It is already in multi-line form at lines 99-105, so the mutation is a single whole-line deletion with no re-indentation, which makes the `git diff --numstat` gate in P1-T5 exactly `0 1`. Mutating one of the `TriageSet*` buttons would entangle F1's fail-proof with F2's edit.
+5. **The three `TriageSet*` buttons are collapsed, not the other five.** `TrainSpam`, `TrainHam`, `TestSpam`, `FilterTriageGroup`, and `ClearTriage` were already multi-line at the merge-base. Collapsing them would be gratuitous churn on lines this change did not author and would exceed the F2 remit, which is limited to reverting incidental reformatting introduced by the implementation cycle.
+6. **The 527 gate is a ceiling, not a target.** The pinned edit yields 524 lines (539 minus fifteen). The gate is expressed as "at or below 527" because that is the figure `remediation-inputs.2026-08-08T14-26.md` binds (519 merge-base plus 8 functional attribute lines), and expressing the gate as equality against 524 would make an unrelated future whitespace normalization a spurious failure.
+7. **No acceptance criterion is checked off.** Every automated AC was already checked off in the implementation cycle, and F1/F2 are quality defects in delivered work rather than unmet criteria. Re-flipping a checkbox would produce a misleading audit trail. The `spec.md` change in P4-T1 is append-only prose.
+8. **Coverage evidence stays compact.** Raw Cobertura reports for this repository are roughly 187,000 lines and 10 MB each. Following the convention established in `<FEATURE>\evidence\qa-gates\coverage-artifact-substitution.2026-08-08T17-40.md`, the raw reports are written to the gitignored `coverage\` directory and only the package-level JaCoCo projections are committed. The projection scripts are session-throwaway scripts held outside the working tree, and their verbatim text is recorded in the P0-T12 and P3-T7 evidence artifacts so the projection remains auditable and reproducible without adding a tracked script file to the repository.
+9. **The AC15 gate compares the working tree, not HEAD.** P3-T10 uses `git diff --numstat <MERGE_BASE> -- <paths>` without `..HEAD` so that an uncommitted edit to a protected file is caught before the commit rather than after. P4-T4 repeats the check in path-scoped `<MERGE_BASE>..HEAD -- <paths>` form once the commit exists, and audits scope against the remediation commit's own diff (`git show --numstat --format= HEAD`) rather than the whole-branch diff, which necessarily contains every implementation-cycle path.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md
new file mode 100644
index 000000000..63cf15bc8
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md
@@ -0,0 +1,446 @@
+# Research — Ribbon Engine Readiness Guard (Issue #503)
+
+- **Issue:** #503
+- **Branch:** `bug/ribbon-engine-readiness-guard-503`
+- **Work mode:** full-bug
+- **Requirements source:** `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/issue.md`
+- **Timestamp:** 2026-08-08T12-45
+- **Status:** Research complete — research only, no code changed.
+
+## 0. Requirement numbering used in this document
+
+The GitHub issue body (verified by fetching <https://github.com/drmoisan/TaskMaster/issues/503>) contains **no explicitly numbered requirements**; only "Steps to Reproduce" is numbered. This document therefore uses the following stable numbering, derived from the issue's own sections, and every downstream reference should use the same mapping:
+
+| Ref | Source text in `issue.md` | Line |
+|---|---|---|
+| **R1** | "There is no published readiness signal on `AppItemEngines`/`IAppItemEngines`" — a readiness signal must be introduced | 66 |
+| **R2** | "the Explorer ribbon XML declares no `getEnabled` callback for the engine-backed buttons" — `getEnabled` wiring must be added | 66 |
+| **R3** | "Clicking a not-yet-ready command produces no exception" — click-handler guards | 33 |
+| **R4** | "Do not change the async engine construction logic, config loading, or dictionary population order inside `AppItemEngines.InitAsync()`" | 78 |
+| **R5a** | "Unit coverage areas: readiness signal …; `RibbonController` engine-readiness predicate; `RibbonViewer` click-handler guards; `RibbonExplorer.xml` `getEnabled` wiring …" | 72 |
+| **R5b** | "Integration scenario to retest: click each engine-backed ribbon command immediately after add-in reload" | 73 |
+| **R5c** | "Manual verification notes: verify `Ribbon.InvalidateControl(...)`/`Invalidate()` refreshes the enabled state" | 74 |
+| **R6** | "Preserve existing `SB`/`TrainAsync` behavior once engines are loaded" | 79 |
+
+---
+
+## 1. Current-state analysis (verified against source)
+
+### 1.1 `TaskMaster\AppGlobals\AppItemEngines.cs`
+
+- Line 26–27: `[ExcludeFromCodeCoverage] public class AppItemEngines : IAppItemEngines`. **The attribute is at type level, so every member of this class is excluded from coverage measurement.** Coverage XML in the repo confirms the tool honours the attribute (`reason="attribute_excluded"` entries, e.g. `docs/features/archive/2026-06-24-folder-tree-cache-and-refresh-214/evidence/qa-gates/final-coverage.xml:62227`). Any readiness logic placed on this class is therefore **uncoverable**.
+- Line 119–123: `public ConcurrentDictionary<string, IConditionalEngine<MailItemHelper>> InboxEngines { get; protected set; } = [];` — initialised to an **empty** dictionary at field-initializer time. This is the sole reason the race window exists.
+- Line 40–86 `InitAsync()`:
+  - Line 50: `var configs = await Globals.AF.Manager.Configuration;` (first await — the long pole).
+  - Line 63–84: the whole `InboxEngines` property is **assigned once**, at the end, from `ToConcurrentDictionaryAsync(...)`. The dictionary is never incrementally filled. Consequence: readiness transitions from "no keys" to "all keys" in a **single reference assignment**, which makes any per-key `ContainsKey` probe a precise and race-free readiness signal for that key.
+  - Line 64: `.Where(config => config.Value.Engine)` — an engine whose config has `Engine == false` is **never** added. So a coarse "initialisation complete" flag would report ready for an engine that will never exist.
+  - Line 68: `EngineInitializer.TryGetValue(config.Key, out var engineAsync)` and line 83 `.Where(tup => tup.Engine is not null)` — factories that return null are dropped as well.
+- Line 111–117 `RestartEngineAsync(string engineName)`: writes a single key via `InboxEngines[engineName] = await engine(Globals);`. Readiness for that key must therefore be re-evaluated after a restart; a per-key probe handles this automatically, a one-shot `IsInitialized` flag does not.
+- Line 129–204 `EngineInitializer` / `GetEngineInitializer()` — the fixed key set is `"Spam"`, `"Triage"`, `"Project"`, `"Context"`, `"Actionable"`.
+- Lines 237–252 (`ShowDiskDialog`) and 276–282 (`ShowSaveInfo`) already use `TryGetValue` and are therefore **already race-safe** (they silently no-op).
+
+### 1.2 `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` — cross-project contract
+
+Full contract (18 lines): `InboxEngines` (get-only), `ToggleEngineAsync`, `EngineActiveAsync`, `ShowSaveInfo`, `ShowDiskDialog`, `RestartEngineAsync`, `InitAsync`.
+
+**Exhaustive implementer / test-double inventory** (verified by `rg ':\s*IAppItemEngines|,\s*IAppItemEngines'` over all `*.cs`, plus a full `rg IAppItemEngines`):
+
+| Kind | Location | Effect if a member is added to the interface |
+|---|---|---|
+| Production implementer | `TaskMaster\AppGlobals\AppItemEngines.cs:27` | **Must implement the new member** (compile break otherwise) |
+| Moq dynamic mock | `TaskMaster.Test\AppGlobals\ApplicationGlobalsTests.cs:92, 120, 334` | No compile break. `MockBehavior.Strict` throws only if the new member is *called*; these mocks only set up `InitAsync` |
+| Moq dynamic mock | `TaskMaster.Test\AppGlobals\ApplicationGlobalsStartupTimingTests.cs:183` | Same |
+| Moq dynamic mock | `TaskMaster.Test\AppGlobals\AppEventsTests.Helpers.cs:20, 39` | Same |
+| `IApplicationGlobals` double (property only) | `QuickFiler.Test\Controllers\EfcHomeControllerTests.cs:212` → `public IAppItemEngines Engines => null;` | **No change required** — implements `IApplicationGlobals`, not `IAppItemEngines` |
+| `IApplicationGlobals` double | `QuickFiler.Test\Controllers\EfcHomeControllerMetricsTests.cs:218` | No change required |
+| `IApplicationGlobals` double | `QuickFiler.Test\Controllers\EfcHomeControllerLifecycleTests.cs:398` | No change required |
+| `IApplicationGlobals` double | `UtilitiesCS.Test\EmailIntelligence\EmailDataMiner_TestSupport.cs:71` → `throw new NotImplementedException()` | No change required |
+| `IApplicationGlobals` double | `TaskMaster.Test\AppGlobals\AppToDoObjectsTestDoubles.cs:171` | No change required |
+| `IApplicationGlobals` double | `TaskMaster.Test\AppGlobals\AppOlObjectsTests.cs:419` | No change required |
+| `IApplicationGlobals` double | `TaskMaster.Test\AppGlobals\AppOlObjectsCoverageTests.cs:328` | No change required |
+| Consumer | `TaskMaster\AppGlobals\ApplicationGlobals.cs:461` `public IAppItemEngines Engines { get; private set; }` | No change required |
+| Consumer | `TaskMaster\Ribbon\RibbonController.Intelligence.cs:204` `internal IAppItemEngines Engines => Globals.Engines;` | No change required |
+| Interface declaration | `UtilitiesCS\Interfaces\IGlobals\IApplicationGlobals.cs:16` | No change required |
+
+**Net ripple of adding an interface member: exactly one production class.** The ripple is *smaller* than expected, so it is not by itself a decisive criterion (see §3).
+
+**Default interface members are unavailable.** `TaskMaster.csproj:30` targets `<TargetFrameworkVersion>v4.8.1</TargetFrameworkVersion>` (`LangVersion` is `preview`, line 31). Microsoft's C# version history states for C# 8.0: *"Default interface members require enhancements in the CLR. Those features were added in the CLR for .NET Core 3.0."* (<https://learn.microsoft.com/en-us/dotnet/csharp/whats-new/csharp-version-history>). A high `LangVersion` does not help — the runtime, not the compiler, is the constraint (Roslyn reports `CS8701 Target runtime doesn't support default interface implementation`). **Confirmed: any member added to `IAppItemEngines` must be implemented explicitly in `AppItemEngines`, i.e. in an `[ExcludeFromCodeCoverage]` class.** This is the decisive constraint.
+
+### 1.3 `TaskMaster\Ribbon\RibbonController.Intelligence.cs`
+
+- The type is `public partial class RibbonController`; the **type-level `[ExcludeFromCodeCoverage]` is declared on the other partial**, `TaskMaster\Ribbon\RibbonController.cs:36`. It applies to the whole type, therefore **`RibbonController.Intelligence.cs` is also uncoverable**, even though `TaskMaster.Test\Ribbon\RibbonControllerTests.cs` exercises it.
+- Line 190–202 `internal SpamBayes SB` — sets a `WindowsFormsSynchronizationContext` if none is current, then `Globals?.Engines?.InboxEngines?.TryGetValue("Spam", out var engine) ?? false ? engine as SpamBayes : null`. **Returns `null` during the window.**
+- Line 279–292 `internal Triage Triage` — identical shape for key `"Triage"`. **Returns `null` during the window.**
+- Line 204 `internal IAppItemEngines Engines => Globals.Engines;` — **not** null-safe on `Globals`.
+- The shared `SynchronizationContext` pattern (`if (SynchronizationContext.Current is null) SynchronizationContext.SetSynchronizationContext(new WindowsFormsSynchronizationContext());`) appears **13 times** in this file (lines 90, 101, 111, 121, 131, 145, 155, 165, 194, 208, 259, 283, 370). It is a side-effecting property getter; a unit test that touched `SB`/`Triage`/`TriageAsync` would install a real `WindowsFormsSynchronizationContext` on the test thread. **New tests must not go through these members.**
+- File length: **412 lines**.
+
+### 1.4 `TaskMaster\Ribbon\RibbonViewer.cs`
+
+- Line 31–33: `[System.Runtime.InteropServices.ComVisible(true)] [ExcludeFromCodeCoverage] public class RibbonViewer : Office.IRibbonExtensibility`. It is **not** currently `partial`.
+- Line 42–54: an existing **internal test-seam constructor** `RibbonViewer(Func<Task> loadFolderFilterAsync, Action<Exception> reportFolderFilterInitializationFailure)` that sets `_controller = null`. Precedent for delegate-seam injection, but it deliberately bypasses the controller, so it cannot be extended to inject a `Mock<IAppItemEngines>` in a way that would produce covered lines (the class is excluded).
+- Line 56: `private Office.IRibbonUI _ribbon;` set at line 91 in `Ribbon_Load`.
+- File length: **487 lines** (cap is 500).
+
+**Exhaustive enumeration of callbacks that dereference an engine from `InboxEngines`:**
+
+| # | Callback (file:line) | Dereference path | Engine key | Failure during window | Ribbon control id |
+|---|---|---|---|---|---|
+| 1 | `TrainSpam_Click` (255–256) | `Controller.SB.TrainAsync(...)` | `Spam` | `NullReferenceException` | `TrainSpam` |
+| 2 | `TrainHam_Click` (258–259) | `Controller.SB.TrainAsync(...)` | `Spam` | `NullReferenceException` | `TrainHam` |
+| 3 | `TestSpam_Click` (261–264) | `Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine` (**indexer**) | `Spam` | `KeyNotFoundException` | `TestSpam` |
+| 4 | `TriageSetA_Click` (303–304) | `_controller.Triage.OlLogic.TrainSelectionAsync("A")` | `Triage` | `NullReferenceException` | `TriageSetA` |
+| 5 | `TriageSetB_Click` (306–307) | same, `"B"` | `Triage` | `NullReferenceException` | `TriageSetB` |
+| 6 | `TriageSetC_Click` (309–310) | same, `"C"` | `Triage` | `NullReferenceException` | `TriageSetC` |
+| 7 | `ClearTriage_Click` (316–317) | `_controller.Triage.OlLogic.UnTrainSelectionAsync()` | `Triage` | `NullReferenceException` | `ClearTriage` |
+| 8 | `FilterViewer_Click` (325–326) | `_controller.Triage.OlLogic.FilterViewAsync()` | `Triage` | `NullReferenceException` | `FilterTriageGroup` |
+
+**Callbacks that touch engines but are already race-safe** (documented so the plan does not over-scope):
+
+- `ClearSpam_Click` (252–253) → `ClearSpamManagerAsync` (Intelligence.cs:206) uses `(await Globals.AF.Manager.Configuration).TryGetValue(...)` then `RestartEngineAsync`; no `InboxEngines` dereference. Safe.
+- `SpamSaveNetwork_Click` / `SpamSaveLocal_Click` / `GetSaveLocation_Click` / `TriageSaveNetwork_Click` / `TriageSaveLocal_Click` / `TriageGetSaveLocation_Click` → `ShowDiskDialog` / `ShowSaveInfo` use `TryGetValue`. Safe (silent no-op).
+- `SpamBayesEnabled_Click` / `TriageEnabled_Click` / `*_GetPressed` → `ToggleEngineAsync` / `EngineActiveAsync` read `Configuration`, not `InboxEngines`. Safe.
+- `TriageSelection_Click`, `SetPrecision_Click`, `ResetTriage_Click` → use `TriageAsync` (`AsyncLazy<Triage>` set by `ResetTriage()` from `SetGlobals`, RibbonController.cs:56) or construct a fresh `Triage`. **Not** an `InboxEngines` dereference.
+- `TestSpamVerbose_Click`, `SpamMetrics_Click`, `SpamInvestigateErrors_Click` → `throw new NotImplementedException()` (Intelligence.cs:235–248). Pre-existing, out of scope.
+
+**Correction to the issue text.** `issue.md:16` asserts the race "affects every ribbon command backed by an engine in `InboxEngines` (Triage, Project, Context, Actionable)". Verified: **no ribbon callback dereferences the `Project`, `Context`, or `Actionable` engines.** `BuildCategoryClassifier_Click` (242–243) and `BuildActionableClassifier_Click` (245–246) construct fresh `CategoryClassifierGroup` / `ActionableClassifierGroup` instances via `RibbonController.BuildCategoryClassifierAsync` / `BuildActionableClassifierAsync` (Intelligence.cs:119–137) and never read `InboxEngines`. The reachable defect surface is exactly the 8 rows above (`Spam` × 3, `Triage` × 5). The catalog should still be built as an extensible map so future `Project`/`Context`/`Actionable` commands are one-line additions.
+
+### 1.5 `TaskMaster\Ribbon\RibbonExplorer.xml`
+
+- Root: `<customUI onLoad="Ribbon_Load" xmlns="http://schemas.microsoft.com/office/2009/07/customui">` (line 2) — the **2009 (customUI14) namespace**.
+- Current length: **519 lines** (already above the 500-line guidance; see §7).
+- The 8 controls that need `getEnabled`, all `<button>` elements:
+
+| Control id | Element | Line | Parent |
+|---|---|---|---|
+| `TrainSpam` | `button` | 99–104 | `group id="SpamBayesGroup"` |
+| `TrainHam` | `button` | 105–110 | `group id="SpamBayesGroup"` |
+| `TestSpam` | `button` | 150–155 | `menu id="OtherSpamActions"` |
+| `TriageSetA` | `button` | 445 | `group id="TriageGroup"` |
+| `TriageSetB` | `button` | 446 | `group id="TriageGroup"` |
+| `TriageSetC` | `button` | 447 | `group id="TriageGroup"` |
+| `FilterTriageGroup` | `button` | 449–454 | `menu id="OtherTriageActions"` |
+| `ClearTriage` | `button` | 455–460 | `menu id="OtherTriageActions"` |
+
+**Schema permission (per Microsoft's CustomUI control reference, <https://learn.microsoft.com/en-us/previous-versions/office/developer/office-2007/aa338199(v=office.12)>):**
+
+| Element | `enabled` / `getEnabled` permitted? |
+|---|---|
+| `button` | **Yes** — listed in the Common attribute set |
+| `toggleButton` | **Yes** |
+| `checkBox` | **Yes** |
+| `menu` | **Yes** |
+| `editBox`, `comboBox`, `dropDown`, `gallery`, `dynamicMenu`, `labelControl`, `splitButton`, `command` | Yes |
+| `group`, `tab` | **No** — `group` and `tab` expose `getVisible` but **not** `getEnabled` |
+
+**Recommendation: put `getEnabled` on the 8 buttons only.** Do **not** put it on `menu id="OtherSpamActions"` or `menu id="OtherTriageActions"`: those menus also contain save-location, folder-settings and enable-toggle commands that are safe and useful during initialisation, so disabling the container would over-restrict the UI. Do **not** attempt `group`-level disabling — the schema does not permit it.
+
+### 1.6 Existing test patterns
+
+`TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` (161 lines) — parses the **embedded resource** `TaskMaster.Ribbon.RibbonExplorer.xml` via `typeof(RibbonController).Assembly.GetManifestResourceStream(...)` (lines 47–59) and asserts structural rules with `XDocument` + FluentAssertions. Fully deterministic, no COM, no temp files. **This is the correct home for the R2 `getEnabled` wiring assertions.**
+
+`TaskMaster.Test\Ribbon\RibbonControllerTests.cs` (452 lines):
+
+- `CreateController()` (lines 56–73) builds `(ApplicationGlobals)FormatterServices.GetUninitializedObject(typeof(ApplicationGlobals))`, reflectively sets the private `_quickFilerSettings` field, then reflectively sets `RibbonController.Globals`.
+- **Can this pattern inject a `Mock<IAppItemEngines>`?** Mechanically yes: `ApplicationGlobals.Engines` (ApplicationGlobals.cs:461) is `public IAppItemEngines Engines { get; private set; }`, so its compiler-generated backing field `<Engines>k__BackingField` can be set by reflection on the uninitialized instance. **But it is the wrong seam for this work**, for three reasons:
+  1. `RibbonController` is `[ExcludeFromCodeCoverage]` (RibbonController.cs:36), so nothing exercised through it counts toward the coverage floor.
+  2. Reaching the readiness decision through `RibbonController.SB`/`Triage` would execute the `SynchronizationContext.SetSynchronizationContext(new WindowsFormsSynchronizationContext())` side effect on the test thread (§1.3).
+  3. It couples the tests to a private backing-field name, which is brittle.
+  The pattern remains available as a *fallback* if the planner wants one end-to-end wiring test, but it must not be the primary coverage vehicle.
+
+`TaskMaster.Test\AppGlobals\HookReadinessCoordinatorTests.cs` + `TaskMaster\AppGlobals\HookReadinessCoordinator.cs` — **the canonical precedent for this exact problem shape.** `HookReadinessCoordinator` (114 lines) is an `internal sealed` host-neutral decision seam that is *deliberately not* `[ExcludeFromCodeCoverage]`; its own doc comment (lines 36–46) states the pattern: *"This is the unit-tested decision seam. It contains no COM, no DispatcherTimer, and no clock … The DispatcherTimer and polling cadence that drive this coordinator are owned by the COM glue in `AppEvents.Hook()` and are COM/VSTO-exempt."* `EngineInitTimingProbe.cs` (110 lines) and `StartupDiagnosticsProbe.cs` carry the same explicit "intentionally NOT marked `[ExcludeFromCodeCoverage]`" remark. **The recommended design in §4 replicates this precedent.**
+
+Internals are reachable: `[assembly: InternalsVisibleTo("TaskMaster.Test")]` at `TaskMaster\ThisAddIn.cs:14` and `TaskMaster\Properties\AssemblyInfo.cs:38`.
+
+### 1.7 Where `InitAsync()` runs, and where `IRibbonUI` is reachable
+
+Call sites of `AppItemEngines.InitAsync()`:
+
+1. `ApplicationGlobals.cs:135` — `await Engines.InitAsync();` inside `LoadParallelAsync()`.
+2. `ApplicationGlobals.cs:417` — `protected internal virtual Task InitializeEnginesPhaseAsync() => Task.Run(() => Engines.InitAsync());`, awaited at line 215 inside `LoadSequentialAsync()`.
+3. `ApplicationGlobals.cs:427` — `IdleAsyncQueue.AddEntry(false, Engines.InitAsync);` inside `LoadWhenIdle()`. (No caller of `LoadWhenIdle()` was found outside the class.)
+
+Live startup path: `ThisAddIn.Application_Startup` (ThisAddIn.cs:71–81) enqueues `await _globals.LoadAsync(false)` with **`useUiThread: true`**. `IdleAsyncQueue.OnApplicationIdle` (IdleAsyncQueue.cs:70–77) then runs it as `await await UiThread.Dispatcher.InvokeAsync(async () => { await entry.actionAsync(); await Task.Yield(); })`. `LoadAsync(false)` (ApplicationGlobals.cs:57, 80–82) selects `LoadSequentialAsync()`.
+
+**Threading conclusion:** because the whole `LoadAsync` continuation chain is pumped by `UiThread.Dispatcher` (a WPF `DispatcherSynchronizationContext` on the STA), the continuation after `await InitializeEnginesPhaseAsync()` **does** resume on the UI/STA thread in the live path, even though the engine construction itself ran on a thread-pool thread via `Task.Run`. So a ribbon-refresh call placed after `await _globals.LoadAsync(false)` in `ThisAddIn` is already on the correct thread. However, the `LoadWhenIdle()` path enqueues with `useUiThread: false` (thread pool) and `LoadParallelAsync()` inherits whatever context its caller had. **Recommendation: marshal the refresh explicitly through `UtilitiesCS.Threading.UiThread.Dispatcher` (UiThread.cs:135) rather than relying on the ambient context.** `IRibbonUI` is a COM object handed to `Ribbon_Load` on the STA and must be called back on the STA.
+
+`Office.IRibbonUI` is reachable only through `RibbonViewer._ribbon` (RibbonViewer.cs:56). The existing precedent for using it is `RibbonController.ToggleEventsHook(Office.IRibbonUI Ribbon)` (RibbonController.cs:182–198), which calls `Ribbon.InvalidateControl("BtnHookToggle")` — but it receives the `IRibbonUI` as a parameter from `RibbonViewer.BtnHookToggle_Click` (RibbonViewer.cs:135–138) rather than holding it. `RibbonController._viewer` is set by `RibbonViewer.Ribbon_Load` → `_controller.SetViewer(this)` (RibbonViewer.cs:92, RibbonController.cs:64–67), so a controller→viewer refresh call is reachable.
+
+### 1.8 Office ribbon `getEnabled` / invalidation mechanics (documented)
+
+- **Callback signature.** From Microsoft's callback signature table (<https://learn.microsoft.com/en-us/previous-versions/office/developer/office-2007/aa722523(v=office.12)>, Table 4): `getEnabled` → **`C#: bool GetEnabled(IRibbonControl control)`**. VSTO additionally requires the method be **`public`**, that its name match the XML attribute value exactly, and that its signature match a valid callback shape; *"If you create a callback method that does not match a valid signature, the code will compile, but nothing will occur when the user clicks the control."* (<https://learn.microsoft.com/en-us/visualstudio/vsto/ribbon-xml>).
+- **One callback can serve many controls.** *"All callback methods have an `IRibbonControl` parameter that represents the control that called the method. You can use this parameter to reuse the same callback method for multiple controls."* (same page). So one `EngineCommand_GetEnabled` dispatching on `control.Id` is the documented pattern.
+- **Response caching.** *"For each of the callbacks that the add-in implements, the responses are cached … This process remains in place for the control until the add-in signals that the cached values are invalid by using the `InvalidateControl` method, at which time, the callback procedure is again called and the return response is cached."* (<https://learn.microsoft.com/en-us/office/vba/api/office.iribbonui.invalidatecontrol>). **Therefore the post-initialisation refresh is load-bearing: without it the buttons stay disabled for the session.**
+- `IRibbonUI.InvalidateControl(bstrControlID)` invalidates one control; `IRibbonUI.Invalidate()` invalidates every control's cached callback values.
+- **Callback ordering is unspecified.** *"Is it possible to predict or control the order in which callbacks are called? No. You should not add logic to your Fluent UI solutions that depends on callbacks being called in a certain order."* (aa722523, §"Is it possible to predict…"). Tests must assert *set* membership of invalidated ids, not sequence.
+- **Threading.** `IRibbonUI` is an Office COM object supplied on the STA during `onLoad`. Calling it from a thread-pool continuation is an STA/COM violation. `InitAsync()` is launched via `Task.Run` (ApplicationGlobals.cs:417), i.e. it *completes* on a thread-pool thread; only the awaiting continuation is marshalled back, and only when a synchronization context was captured. **Implication: the refresh call must be explicitly marshalled to `UiThread.Dispatcher` at the shim, not left to the ambient context.**
+
+---
+
+## 2. Behaviour semantics
+
+**Readiness definition (per engine key `k`).** `k` is *ready* iff `Globals?.Engines?.InboxEngines` is non-null **and** `InboxEngines.TryGetValue(k, out var e)` is true **and** `e is not null`. String comparison is the `ConcurrentDictionary` default — **ordinal, case-sensitive** — so `"spam"` is not `"Spam"`.
+
+**State model.**
+
+| State | `InboxEngines` contents | `GetEnabled(id)` | Click behaviour |
+|---|---|---|---|
+| S0 — pre-init | empty (field initializer) | `false` | no-op + one diagnostic line; **no exception** |
+| S1 — init in flight | still empty (single terminal assignment, §1.1) | `false` | as S0 |
+| S2 — init complete, engine present | key present, non-null | `true` | **unchanged from today** (R6) |
+| S3 — init complete, engine filtered out by config (`Engine == false`) or factory returned null | key absent | `false` | no-op + diagnostic; **no exception** |
+| S4 — engine restarted (`RestartEngineAsync`) | key re-assigned | recomputed on next query | unchanged |
+| S5 — `InitAsync` threw | empty | `false` | no-op; fail-safe |
+
+**Transitions.** S0/S1 → S2 or S3 happens at the single `InboxEngines = …` assignment (AppItemEngines.cs:63). The ribbon does not observe the transition until an `InvalidateControl`/`Invalidate` call forces a re-query; until then the cached `false` persists.
+
+**Success / failure conditions.**
+
+- Success: a click during S0/S1/S3/S5 produces no exception and no user-visible side effect; a click in S2 behaves byte-identically to today.
+- Failure: any exception escaping an `async void` handler; any change to which engines get constructed or in what order; any command that stays disabled after S2 + refresh.
+
+**Edge cases.**
+
+- `Globals` null (before `RibbonController.SetGlobals`) — must yield `false`, not NRE. Note `RibbonController.Engines` (Intelligence.cs:204) is **not** null-safe on `Globals`; the readiness accessor must be `() => Globals?.Engines`.
+- Unknown / null / empty `control.Id` → `false` (a non-engine control must never be disabled by this callback).
+- Ribbon not yet loaded (`_ribbon is null`) when the refresh fires → no-op, no throw.
+- The action itself throwing (e.g. `TrainAsync` fails on a real mail item) → **must propagate**, per the repo's fail-fast rule. The guard suppresses *invocation*, never *errors*.
+- Double refresh (e.g. startup refresh plus a post-`RestartEngineAsync` refresh) → idempotent.
+
+---
+
+## 3. Options analysis
+
+### Option (a) — `Task InitTask` / `bool IsInitialized` on `AppItemEngines` + `IAppItemEngines`
+
+Add a coarse "initialisation finished" signal, set at the end of `InitAsync()`.
+
+- **R1:** satisfied in form.
+- **R4:** *violated in spirit.* `InitAsync()` must gain a statement (`_isInitialized = true;` or capturing the task), which is a change inside the method R4 fences off. It is additive rather than reordering, but it is still an edit to the constrained method.
+- **Correctness gap (decisive):** `InitAsync` filters on `config.Value.Engine` (AppItemEngines.cs:64) and drops null factories (line 83). In state S3 the flag reports `true` while `InboxEngines["Spam"]` is absent — so `TrainSpam_Click` would be *enabled* and would still NRE. It also does not react to `RestartEngineAsync` (line 111) replacing a key.
+- **Coverage:** the flag lives on `[ExcludeFromCodeCoverage] AppItemEngines`; no coverable lines produced.
+- **Ripple:** 1 production implementer (no DIM available, §1.2).
+- **Verdict: rejected** — wrong granularity, produces a false-positive enabled state, touches `InitAsync`.
+
+### Option (b) — per-engine predicate `bool IsEngineReady(string engineName)` on `IAppItemEngines`
+
+- **R1:** satisfied, with the right granularity.
+- **R4:** satisfied — `InitAsync()` untouched.
+- **Coverage (decisive):** the implementation necessarily lives on `AppItemEngines`, which is `[ExcludeFromCodeCoverage]` (line 26). Because .NET Framework 4.8.1 has **no default-interface-member support** (§1.2), the body cannot be placed on the interface either. The new logic would therefore be **entirely uncoverable**, which is exactly the substitution the maintainer rejected in the issue #227 precedent (`[ExcludeFromCodeCoverage]` as a stand-in for a real testability seam).
+- **Ripple:** 1 production class; Moq mocks unaffected at compile time (they would need `.Setup(x => x.IsEngineReady(...))` only where called).
+- **Public surface:** widens a cross-project interface for a single consumer, against the "keep public surface minimal / prefer `internal`" rule.
+- **Verdict: rejected** — correct semantics, uncoverable implementation.
+
+### Option (c) — readiness computed from the existing `InboxEngines` member, in a new host-neutral type ✅ **SELECTED**
+
+- **R1:** satisfied. The readiness signal is *published* — it is a first-class, named, unit-tested type (`EngineReadinessGate`) with an explicit contract, rather than an ad-hoc inline expression. `IAppItemEngines.InboxEngines` is already on the interface (line 9), so no contract change is needed to observe it.
+- **R4:** satisfied **with a zero-line diff to `AppItemEngines.cs`** — the strongest possible compliance.
+- **Correctness:** exactly per-key. Handles S3 (config-filtered engine) and S4 (`RestartEngineAsync`) correctly and automatically, because it reads the live dictionary.
+- **Coverage (decisive advantage):** the gate, the control→engine catalog, and the click guard are all new types that are **not** `[ExcludeFromCodeCoverage]`, are constructed from plain delegates, and are directly unit-testable with Moq + FluentAssertions. This matches the `HookReadinessCoordinator` / `EngineInitTimingProbe` precedent verbatim.
+- **Ripple:** **zero** test doubles and **zero** interface changes.
+- **Race safety:** `ConcurrentDictionary.TryGetValue` is thread-safe, and `InitAsync` performs a single reference assignment of the whole dictionary, so a probe never observes a partially populated map.
+- **Trade-off (recorded):** the readiness contract is a *convention* over an existing member rather than a compiler-enforced interface member. Mitigation: the gate is the single chokepoint, it is `internal sealed`, and it is covered by unit tests that pin the semantics.
+
+**Rejected alternatives — one-line summary.** (a) `IsInitialized`/`InitTask`: wrong granularity (reports ready for engines that were config-filtered out), and requires editing `InitAsync()`. (b) `IsEngineReady` on `IAppItemEngines`: semantically correct but the body can only live on the `[ExcludeFromCodeCoverage]` `AppItemEngines` because net481 has no default interface members, so it produces no covered lines.
+
+---
+
+## 4. Recommended design
+
+### 4.1 Seam choice
+
+Per `.claude/rules/csharp.md` "DI Seams" preference order:
+
+1. **Interface seam** — not used for the readiness contract itself (that is Option (b), rejected above). The gate *consumes* the existing `IAppItemEngines` interface, which already provides the needed observation point.
+2. **Injectable delegate seam (chosen)** — `Func<IAppItemEngines>` supplies the engines container, and `Action<string>` supplies the diagnostic sink. This mirrors `EngineInitTimingProbe(Action<string> emit)` (EngineInitTimingProbe.cs:37) and `HookReadinessCoordinator(IOutlookReadinessGate, Action)` (HookReadinessCoordinator.cs:63) exactly.
+3. **Adapter seam** — used for the ribbon: `Action<string> invalidateControl` adapts the static/COM `IRibbonUI.InvalidateControl` so the "which controls to invalidate" decision is testable without an `IRibbonUI`.
+
+### 4.2 Type inventory (all new types in `TaskMaster\Ribbon\`, all `internal sealed`, none `[ExcludeFromCodeCoverage]`)
+
+**`EngineCommandCatalog`** — pure static map, no dependencies.
+- `static bool TryGetEngineName(string controlId, out string engineName)` — ordinal lookup; `false` for null/unknown.
+- `static IReadOnlyCollection<string> ControlIds { get; }` — the 8 ids from §1.4.
+- Rationale: the control-id↔engine-key binding is the one piece of knowledge shared by the XML, the `getEnabled` callback, the click guards, and the refresh; centralising it is what lets a single test assert XML/code agreement.
+
+**`EngineReadinessGate`** — the R1 readiness signal.
+- `EngineReadinessGate(Func<IAppItemEngines> enginesAccessor)`; null accessor → `ArgumentNullException` (constructor-time invariant, per repo policy).
+- `bool IsEngineReady(string engineName)` — `false` for null/whitespace name, null accessor result, null `InboxEngines`, missing key, or null value; otherwise `true`.
+- `bool TryGetEngine(string engineName, out IConditionalEngine<MailItemHelper> engine)` — same predicate, returning the instance, for callers that want the engine.
+- Contains **zero** `Microsoft.Office.*` references.
+
+**`EngineGatedCommandRunner`** — the R3 click guard and the `getEnabled` decision.
+- `EngineGatedCommandRunner(EngineReadinessGate gate, Action<string> emitSkipDiagnostic)`.
+- `bool IsCommandEnabled(string controlId)` → `EngineCommandCatalog.TryGetEngineName(...) && gate.IsEngineReady(name)`; `false` for unknown ids.
+- `Task RunAsync(string controlId, Func<Task> action)` — null `action` → `ArgumentNullException`; if `!IsCommandEnabled(controlId)` emit **one** structured skip line and return `Task.CompletedTask` **without invoking `action`**; otherwise `await action()` and let any exception propagate (fail-fast).
+- Critically, the caller passes a **lambda**, so `Controller.SB` / `Controller.Triage` are only dereferenced *inside* the lambda and are never evaluated when the gate is closed. This is what turns the NRE into a no-op without a `?.` sprinkle across `RibbonViewer`.
+
+**`EngineCommandRefreshPlanner`** (or a static method on the catalog) — the R5c refresh decision.
+- `static void InvalidateAll(Action<string> invalidateControl)` — null delegate → `ArgumentNullException`; invokes the delegate once per `EngineCommandCatalog.ControlIds` entry.
+- Keeps "which controls to invalidate" coverable while `IRibbonUI.InvalidateControl` stays in the excluded shim.
+
+### 4.3 Thin, uncovered shims (all in already-excluded types)
+
+- `TaskMaster\Ribbon\RibbonController.EngineCommands.cs` (new partial of the existing `[ExcludeFromCodeCoverage]` `RibbonController`):
+  - lazily builds `EngineReadinessGate(() => Globals?.Engines)` — the `?.` is what makes the pre-`SetGlobals` case safe;
+  - exposes `internal bool IsEngineCommandEnabled(string controlId)`, `internal Task RunEngineCommandAsync(string controlId, Func<Task> action)`, and `internal void RefreshEngineCommands()` which forwards to `_viewer`.
+- `TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` (new partial; requires changing `public class RibbonViewer` → `public partial class RibbonViewer` at RibbonViewer.cs:33):
+  - `public bool EngineCommand_GetEnabled(Office.IRibbonControl control) => _controller?.IsEngineCommandEnabled(control?.Id) ?? false;` — the **only** new Office-typed surface;
+  - `internal void InvalidateEngineCommands()` — null-checks `_ribbon`, marshals to `UiThread.Dispatcher` when `!Dispatcher.CheckAccess()`, then calls `EngineCommandRefreshPlanner.InvalidateAll(_ribbon.InvalidateControl)`;
+  - hosts the relocated `#region Spam Manager` and `#region Triage` callbacks, rewritten as e.g.
+    `public async void TrainSpam_Click(Office.IRibbonControl control) => await Controller.RunEngineCommandAsync("TrainSpam", () => Controller.SB.TrainAsync(Controller.OlSelection, true));`
+- `TaskMaster\ThisAddIn.cs` — one statement after `await _globals.LoadAsync(false);` (line 76): `_ribbonController.RefreshEngineCommands();`. Already inside a `useUiThread: true` idle-queue entry, i.e. on the STA (§1.7).
+
+### 4.4 Architecture-boundaries compliance (`.claude/rules/architecture-boundaries.md`)
+
+Rules 1–4 ban new runtime code that references `Microsoft.Office.Tools.*` / `Microsoft.Office.Interop.Outlook`, exposes `[ComVisible(true)]`, or uses desktop ribbon callbacks. Findings:
+
+- **No enforcement stage exists in this repository today.** There is no `*.ArchitectureTests` project (`rg`/glob for `*ArchitectureTests*` → no files) and no `quality-tiers.yml` at repo root (the file the rule requires for classification is absent). The rule set is aspirational for the future No-COM backend, and the ".NET (when the backend exists)" qualifier in the rule text is explicit.
+- **The work is nevertheless compliant in substance** under the recommended design: no new `[ComVisible(true)]` type is introduced (the attribute stays on the existing `RibbonViewer`, and a `partial` split does not add a second attribute); the only new Office-typed member is one `bool EngineCommand_GetEnabled(Office.IRibbonControl)` inside the pre-existing COM-visible, coverage-exempt shim; and all four new decision types have **zero** `Microsoft.Office.*` or `Microsoft.Office.Interop.Outlook` using directives.
+- **Recommendation to record in the plan:** state explicitly that the Office-typed surface added by this fix is exactly one method on an existing exempt shim, and that the decision logic is host-neutral and portable if the ribbon is later replaced by an Office.js command surface.
+
+---
+
+## 5. Requirements mapping and file-change list
+
+| Ref | Satisfied by |
+|---|---|
+| R1 | `EngineReadinessGate` (new, covered) |
+| R2 | `getEnabled="EngineCommand_GetEnabled"` on 8 buttons + `EngineCommand_GetEnabled` shim + XML regression tests |
+| R3 | `EngineGatedCommandRunner.RunAsync` + rewritten handlers |
+| R4 | **zero-line diff to `AppItemEngines.cs`** and to `IAppItemEngines.cs` |
+| R5a | `EngineReadinessGateTests`, `EngineCommandCatalogTests`, `EngineGatedCommandRunnerTests`, extended `RibbonExplorerXmlTests` |
+| R5b | Manual (see §8) |
+| R5c | `EngineCommandRefreshPlanner` unit test + manual confirmation (see §8) |
+| R6 | Handlers keep the identical `Controller.SB.TrainAsync(Controller.OlSelection, true)` expression inside the lambda; enabled-path tests assert the action is invoked exactly once |
+
+### Enumerated file changes with predicted line deltas
+
+| # | File (absolute) | Action | Current | Predicted | Δ |
+|---|---|---|---|---|---|
+| 1 | `C:\...\TaskMaster\Ribbon\EngineCommandCatalog.cs` | **new** | — | ~75 | +75 |
+| 2 | `C:\...\TaskMaster\Ribbon\EngineReadinessGate.cs` | **new** | — | ~85 | +85 |
+| 3 | `C:\...\TaskMaster\Ribbon\EngineGatedCommandRunner.cs` | **new** | — | ~90 | +90 |
+| 4 | `C:\...\TaskMaster\Ribbon\EngineCommandRefreshPlanner.cs` | **new** | — | ~45 | +45 |
+| 5 | `C:\...\TaskMaster\Ribbon\RibbonController.EngineCommands.cs` | **new** (partial) | — | ~75 | +75 |
+| 6 | `C:\...\TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs` | **new** (partial) | — | ~150 | +150 |
+| 7 | `C:\...\TaskMaster\Ribbon\RibbonViewer.cs` | edit: `class`→`partial class` (line 33); move `#region Spam Manager` (250–296) and `#region Triage` (298–347) into file 6 | 487 | **~389** | **−98** |
+| 8 | `C:\...\TaskMaster\Ribbon\RibbonExplorer.xml` | edit: add `getEnabled` to 8 buttons | 519 | 527 | +8 |
+| 9 | `C:\...\TaskMaster\ThisAddIn.cs` | edit: 1 refresh call + why-comment after line 76 | 300 | ~303 | +3 |
+| 10 | `C:\...\TaskMaster\TaskMaster.csproj` | edit: 6 `<Compile Include>` entries near lines 407–463 | 1000+ | +6 | +6 |
+| 11 | `C:\...\TaskMaster\AppGlobals\AppItemEngines.cs` | **NO CHANGE** (R4) | 286 | 286 | 0 |
+| 12 | `C:\...\UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` | **NO CHANGE** | 18 | 18 | 0 |
+| 13 | `C:\...\TaskMaster\AppGlobals\ApplicationGlobals.cs` | **NO CHANGE** | — | — | 0 |
+| 14 | `C:\...\TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs` | **new** | — | ~140 | +140 |
+| 15 | `C:\...\TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs` | **new** | — | ~190 | +190 |
+| 16 | `C:\...\TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` | **new** | — | ~210 | +210 |
+| 17 | `C:\...\TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs` | **new** | — | ~90 | +90 |
+| 18 | `C:\...\TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` | edit: add 4 tests | 161 | ~265 | +104 |
+| 19 | `C:\...\TaskMaster.Test\TaskMaster.Test.csproj` | edit: 4 `<Compile Include>` entries near line 311 | — | +4 | +4 |
+
+Every predicted file stays under the 500-line cap. Note the **net −98 on `RibbonViewer.cs`** is what buys headroom; without the region move, `RibbonViewer.cs` would land at roughly 495–505 lines and risk breaching the cap.
+
+### Test-double ripple (exhaustive)
+
+**Zero.** No `IAppItemEngines` member is added, so none of the four `Mock<IAppItemEngines>` sites (`ApplicationGlobalsTests.cs:92,120,334`; `ApplicationGlobalsStartupTimingTests.cs:183`; `AppEventsTests.Helpers.cs:20,39`) and none of the seven `IApplicationGlobals` hand-rolled doubles (`EfcHomeControllerTests.cs:212`, `EfcHomeControllerMetricsTests.cs:218`, `EfcHomeControllerLifecycleTests.cs:398`, `EmailDataMiner_TestSupport.cs:71`, `AppToDoObjectsTestDoubles.cs:171`, `AppOlObjectsTests.cs:419`, `AppOlObjectsCoverageTests.cs:328`) requires an edit. This is the single largest practical advantage of Option (c) over Options (a)/(b), which would each require editing `AppItemEngines.cs`.
+
+---
+
+## 6. Testing implications (no test code written)
+
+Framework: **MSTest** + **Moq** + **FluentAssertions** only. Every test below is deterministic, uses no temp files, no `Thread.Sleep`/`Task.Delay`, no WinForms message pump, no `Form`/`MessageBox`, and no live COM. `IConditionalEngine<MailItemHelper>` is mockable (`new Mock<IConditionalEngine<MailItemHelper>>().Object` — precedent at `EngineInitTimingProbeTests.cs:21–22`).
+
+**`EngineReadinessGateTests` (R1, R5a)**
+1. `IsEngineReady_WhenAccessorReturnsNull_ReturnsFalse` — models pre-`SetGlobals`.
+2. `IsEngineReady_WhenInboxEnginesIsEmpty_ReturnsFalse` — **the #503 repro window**.
+3. `IsEngineReady_WhenKeyPresentWithNonNullEngine_ReturnsTrue`.
+4. `IsEngineReady_WhenKeyPresentWithNullValue_ReturnsFalse`.
+5. `IsEngineReady_WithNullOrWhitespaceName_ReturnsFalse`.
+6. `IsEngineReady_IsOrdinalCaseSensitive` — `"spam"` vs `"Spam"`.
+7. `IsEngineReady_AfterDictionaryPopulated_ReturnsTrue` — mutate the same `ConcurrentDictionary` between two calls; models the S1→S2 transition and `RestartEngineAsync`, with no timing dependency.
+8. `TryGetEngine_WhenReady_OutputsSameInstance` / `_WhenNotReady_OutputsNull`.
+9. `Constructor_WithNullAccessor_ThrowsArgumentNullException`.
+
+**`EngineCommandCatalogTests` (R2, R5a)**
+10. `TryGetEngineName_ForEachEngineBackedControlId_ReturnsExpectedEngineName` — data rows for all 8 ids from §1.4.
+11. `TryGetEngineName_ForUnknownControlId_ReturnsFalse`.
+12. `TryGetEngineName_WithNullControlId_ReturnsFalse`.
+13. `ControlIds_ContainsExactlyTheEightEngineBackedControlIds`.
+14. `ControlIds_ContainsNoDuplicates`.
+
+**`EngineGatedCommandRunnerTests` (R3, R6, R5a)**
+15. `RunAsync_WhenEngineNotReady_DoesNotInvokeAction` — **the primary regression test for #503**: asserts no throw and that the action delegate was never entered.
+16. `RunAsync_WhenEngineNotReady_EmitsOneSkipDiagnosticContainingControlIdAndEngineName`.
+17. `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` — R6.
+18. `RunAsync_WhenEngineReady_AwaitsActionToCompletion` — drive with a `TaskCompletionSource` completed synchronously by the test; no delays.
+19. `RunAsync_WhenActionThrows_PropagatesException` — fail-fast; the guard must not become a swallow-all.
+20. `RunAsync_WithUnknownControlId_DoesNotInvokeAction`.
+21. `RunAsync_WithNullAction_ThrowsArgumentNullException`.
+22. `IsCommandEnabled_ReturnsFalseWhenNotReady_TrueWhenReady_FalseForUnknownId` (three focused tests) — this is the `getEnabled` decision.
+
+**`EngineCommandRefreshPlannerTests` (R5c, R5a)**
+23. `InvalidateAll_InvokesDelegateOnceForEachEngineBackedControlId` — assert the captured id **set** equals `EngineCommandCatalog.ControlIds` (not the order — Office documents callback order as unspecified).
+24. `InvalidateAll_WithNullDelegate_ThrowsArgumentNullException`.
+
+**`RibbonExplorerXmlTests` additions (R2, R5a)**
+25. `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` — for each `EngineCommandCatalog.ControlIds` entry, the element exists in the XML and carries `getEnabled="EngineCommand_GetEnabled"`.
+26. `RibbonExplorerXml_GetEnabledCallbackMatchesOfficeSignatureOnRibbonViewer` — reflection over `typeof(RibbonViewer)`: a `public` instance method `EngineCommand_GetEnabled` returning `bool` with exactly one parameter of type `Microsoft.Office.Core.IRibbonControl`. This is the guard against the documented "wrong signature compiles but silently does nothing" failure mode.
+27. `RibbonExplorerXml_GetEnabledIsDeclaredOnlyOnEngineBackedControls` — no other element carries `getEnabled="EngineCommand_GetEnabled"`, so the fix cannot silently over-disable the UI.
+28. `RibbonExplorerXml_EngineBackedControlsAreSchemaLegalForGetEnabled` — every catalog id resolves to a `button`/`toggleButton`/`checkBox`/`menu` element (the schema-permitted set, §1.5), never `group`/`tab`.
+
+**Coverage targets.** CLAUDE.md (authority #1) requires repository line coverage `>= 80%` and `>= 90%` for any new module/class/method; `.claude/rules/general-unit-test.md` states `>= 85%` line / `>= 75%` branch. Target the **stricter** of the two: the four new types should reach `>= 90%` line coverage, which is achievable because they contain no host-bound code. Baseline and post-change coverage XML must be captured under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/` and `.../evidence/qa-gates/` respectively (canonical evidence locations).
+
+**Explicitly NOT tested by unit tests** (and why): `RibbonViewer.EngineCommand_GetEnabled`, `RibbonViewer.InvalidateEngineCommands`, `RibbonController.*` shims, and the `ThisAddIn` refresh call. All live in `[ExcludeFromCodeCoverage]` types and consist of null-checks plus one delegating call each. This matches the ratified COM/VSTO/WinForms exemption in CLAUDE.md and the `HookReadinessCoordinator` precedent. The exemption is being used for *thin wiring only* — the decision logic is fully covered — which is the distinction the maintainer required in the #227 precedent.
+
+---
+
+## 7. Constraints recorded
+
+- **R4 honoured absolutely:** `AppItemEngines.InitAsync()` engine construction, config loading, and dictionary-population order are untouched; `AppItemEngines.cs` has a **zero-line diff**.
+- **500-line cap** (`.claude/rules/general-code-change.md`): `RibbonViewer.cs` is at **487/500** and `RibbonController.Intelligence.cs` at **412/500**. Adding the new callbacks directly to `RibbonViewer.cs` would breach the cap. **Recommendation: partial-class split** into `RibbonViewer.EngineCommands.cs` (requires `public class` → `public partial class` at RibbonViewer.cs:33) **and** relocation of the `#region Spam Manager` / `#region Triage` blocks (lines 250–347) into it, bringing `RibbonViewer.cs` to ~389 lines. `RibbonController` is already `partial`, so `RibbonController.EngineCommands.cs` needs no declaration change.
+- **`RibbonExplorer.xml` is already 519 lines**, above the 500 guidance, *before* this change; the 8 added attributes take it to ~527. The cap text scopes to "production code, test code, or reusable script file"; an embedded declarative UI resource is arguably outside that scope, and the overage is pre-existing. **Recommendation: record the fact, do not expand scope to split the ribbon XML in this bugfix.** If the planner disagrees, splitting the ribbon into multiple embedded resources is a separate, larger change (the loader at `RibbonViewer.GetCustomUI`, line 70–84, returns a single resource).
+- **Toolchain note:** CSharpier is file-based and formats `*.cs` only — it will **not** reformat `RibbonExplorer.xml`. The XML must be hand-edited to match the surrounding one-attribute-per-line style.
+- **Nullable:** `TaskMaster.csproj` declares no `<Nullable>` element, but the type-check gate runs `msbuild ... /p:Nullable=enable /p:TreatWarningsAsErrors=true`. New files must be nullable-clean under that global override. Follow the `HookReadinessCoordinator` style (guard clauses + `?? throw new ArgumentNullException`) rather than the scoped `#nullable enable annotations` pragma used in `EngineInitTimingProbe.cs:60`, which was only needed there for a pre-existing `?` annotation.
+- **Determinism:** no `Thread.Sleep` / `Task.Delay` (also banned via `BannedSymbols.txt`), no wall-clock reads, no temp files, no message pump, no live COM.
+
+---
+
+## 8. Automation Feasibility
+
+**Can be verified fully automatically (no human, no third-party UI):**
+
+- R1 — readiness semantics across all six states S0–S5 (`EngineReadinessGateTests`).
+- R3 — the guard suppresses invocation and does not swallow real errors (`EngineGatedCommandRunnerTests`).
+- R2 — that the 8 controls declare `getEnabled`, that no other control does, that each is a schema-legal element type, and that the named callback exists on `RibbonViewer` with the exact Office-required signature `bool (Office.IRibbonControl)` (extended `RibbonExplorerXmlTests`, using the embedded resource — no Outlook needed).
+- R5c (partially) — that the refresh planner requests invalidation for exactly the 8 engine-backed control ids (`EngineCommandRefreshPlannerTests`).
+- R4 — enforceable as a diff assertion: `AppItemEngines.cs` and `IAppItemEngines.cs` must appear with zero changed lines in the branch diff. (Precedent for source-text assertions in this suite: `RibbonControllerTests.RibbonFolderOperations_DoNotConstructThrowawayFolderTrees`, lines 296–311, reads a production file and asserts on its text.)
+- Full toolchain: CSharpier, both msbuild gates, and `vstest.console.exe /EnableCodeCoverage`.
+
+**Requires human interaction with a third-party UI — cannot be automated in this repository:**
+
+- **R5b** — clicking each of the 8 ribbon commands in a live Outlook Explorer immediately after add-in reload, and confirming no `NullReferenceException`/`KeyNotFoundException` appears in the log. This requires a running Outlook process, a live mail profile, and physical/UI-automated clicks on the Office ribbon. There is no Outlook UI-automation harness in this repository, and the general unit-test policy prohibits tests that depend on external processes.
+- **R5c (the visual half)** — confirming that Office actually greys the buttons out during initialisation and re-enables them after `InvalidateControl` fires. Office's callback-caching behaviour is internal to the host; only Outlook can demonstrate it. The `getEnabled` cache/invalidate contract is documented (§1.8) but not locally observable.
+- Confirming that the `getEnabled` callback is *bound* at all (VSTO silently ignores signature mismatches). Test 26 reduces this risk to near zero by asserting the reflected signature, but only a live load proves binding.
+
+**Recommended handling.** Treat R5b and R5c-visual as a **documented manual verification checklist** in the feature folder, executed by the maintainer, with the outcome recorded under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/`. Do not attempt to satisfy them with an automated test; do not mark the corresponding acceptance criteria complete on the strength of unit tests alone. Everything else on the acceptance list is automatable and should gate the PR.
+
+**Partial mitigation available.** `TaskMaster.Test\AppGlobals\LiveOutlookHarnessRunner.cs` / `LiveOutlookHookupIntegrationTests.cs` exist as a live-Outlook harness precedent. Extending that harness to drive ribbon callbacks was **not** evaluated in depth here; it would still require a live Outlook process and therefore cannot run in the standard deterministic unit-test pass. Flagged as optional follow-up, not a recommendation for this fix.
+
+---
+
+## 9. Out-of-scope defects discovered (recommend promotion to separate issues)
+
+These were found while establishing ground truth. None should be fixed inside #503; each should be promoted through the issue-promotion lifecycle so it is not lost when this feature folder merges.
+
+1. **Five orphan `onAction` callbacks in `RibbonExplorer.xml`.** Verified by `rg` over all `*.cs`: no method exists for `BtnMigrateIDs_Click` (XML line 82), `MoveEntireConversation_Clicked` (line 262), `SaveAttachments_Clicked` (line 268), `SaveEmailCopy_Clicked` (line 274), `SavePictures_Clicked` (line 280). The `RibbonViewer` methods are named `MoveEntireConversation_Click`, `SaveAttachments_Click`, `SaveEmailCopy_Click`, `SavePictures_Click` (RibbonViewer.cs:180, 186, 192, 198) — a `_Clicked` vs `_Click` suffix mismatch. Per Microsoft's VSTO guidance the code compiles and **nothing happens when the user clicks the control**, so all four Quick Filer settings check boxes and the Migrate-IDs button are silently inert. Severity: medium (silent feature loss). A generalised "every `onAction`/`get*` callback resolves to a public `RibbonViewer` method" XML test would catch this class of bug, but it would fail immediately on these five, so it must ship with the fix, not with #503.
+
+2. **Invalid `getPressed` callback signatures.** `RibbonViewer.SpamBayesEnabled_GetPressed` (line 279) and `TriageEnabled_GetPressed` (line 333) are declared `public async Task<bool> ...(Office.IRibbonControl control)`. The documented signature is `bool GetPressed(IRibbonControl control)`; an `async Task<bool>` does not match, so the check-box pressed state is never applied. Both are referenced from the XML (`getPressed="SpamBayesEnabled_GetPressed"` line 140, `getPressed="TriageEnabled_GetPressed"` line 501).
+
+3. **Fire-and-forget `ToggleEngineAsync`.** `SpamBayesEnabled_Click` (line 276–277) and `TriageEnabled_Click` (line 330–331) call `Controller.Engines.ToggleEngineAsync(...)` without `await` in a `void` method, discarding the task and any exception.
+
+4. **`RibbonController.Engines` is not null-safe on `Globals`** (Intelligence.cs:204), unlike the sibling `SB`/`Triage` properties which use `Globals?.`. Reached by `TestSpam_Click` and all six `Spam*`/`Triage*` config callbacks before `SetGlobals` runs.
+
+---
+
+## 10. Summary of the recommendation
+
+Introduce a **per-key readiness signal computed from the existing `IAppItemEngines.InboxEngines` member**, implemented in four new host-neutral `internal sealed` types under `TaskMaster\Ribbon\` that are deliberately *not* `[ExcludeFromCodeCoverage]`, following the `HookReadinessCoordinator` precedent. Wire them into the ribbon through one new `public bool EngineCommand_GetEnabled(Office.IRibbonControl)` shim on a new `RibbonViewer` partial, add `getEnabled="EngineCommand_GetEnabled"` to the 8 engine-backed `<button>` elements, route the 8 affected click handlers through a gated runner whose lambda defers the engine dereference, and invalidate those 8 controls once from `ThisAddIn` after `LoadAsync` completes on the STA. `AppItemEngines.cs` and `IAppItemEngines.cs` are not modified at all, the test-double ripple is zero, and all decision logic is unit-testable with MSTest + Moq + FluentAssertions.
diff --git a/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
new file mode 100644
index 000000000..a30425f0b
--- /dev/null
+++ b/docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/spec.md
@@ -0,0 +1,564 @@
+# ribbon-engine-readiness-guard (Spec)
+
+- **Issue:** #503
+- **Parent (optional):** none
+- **Owner:** drmoisan
+- **Last Updated:** 2026-08-08
+- **Status:** Delivered
+- **Version:** 1.0
+- **Work Mode:** full-bug
+- **Branch:** `bug/ribbon-engine-readiness-guard-503`
+- **Feature folder:** `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/`
+
+> **Authoritative AC source.** Work mode is `full-bug`. Per `.claude/skills/acceptance-criteria-tracking/SKILL.md`, this file is the **sole** authoritative acceptance-criteria source for issue #503. No `user-story.md` exists for this issue and none is to be created.
+
+> **Authority order for this document.** The research artifact `research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md` is authoritative over `issue.md` wherever the two conflict. Every such conflict is recorded in the `## Correction Log` at the end of this document.
+
+---
+
+## Context
+
+Engine-backed Explorer-ribbon commands are invokable before `AppItemEngines.InitAsync()` has populated `Globals.Engines.InboxEngines`. During that window the ribbon has no way to observe initialization progress, so a click reaches a dereference of an engine that does not yet exist and throws out of an `async void` handler.
+
+Environment:
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8.1 (`TaskMaster.csproj:30` `<TargetFrameworkVersion>v4.8.1</TargetFrameworkVersion>`), TaskMaster VSTO add-in
+- Trigger: Outlook Explorer ribbon, an engine-backed button clicked immediately after add-in reload
+- Data source or fixture: Live Outlook profile; `Globals.AF.Manager.Configuration` still resolving
+
+Impact / Severity:
+
+- [ ] Blocker
+- [x] High
+- [ ] Medium
+- [ ] Low
+
+An unhandled exception on a routine ribbon click immediately after add-in reload. The window is short but reliably reachable, and the failure mode is an unhandled `async void` throw on the message-pump synchronization context rather than a recoverable message.
+
+---
+
+## Repro & Evidence
+
+Steps to reproduce:
+
+1. Reload the TaskMaster add-in (or restart Outlook) so `AppItemEngines.InitAsync()` begins.
+2. Before `InitAsync()` completes, click "Train Spam" (or any of the eight commands enumerated in *Verified defect surface* below) in the Explorer ribbon.
+3. Observe the unhandled exception.
+
+Expected:
+
+Engine-dependent ribbon commands are not invokable until their backing engine in `InboxEngines` is available. Clicking a not-yet-ready command produces no exception; once `InitAsync()` completes, the commands become enabled and behave exactly as they do today.
+
+Actual:
+
+`RibbonController.SB` (`TaskMaster/Ribbon/RibbonController.Intelligence.cs:190-202`) evaluates
+`Globals?.Engines?.InboxEngines?.TryGetValue("Spam", out var engine) ?? false ? engine as SpamBayes : null`
+against an empty `ConcurrentDictionary` and returns `null`. `RibbonViewer.TrainSpam_Click` (`TaskMaster/Ribbon/RibbonViewer.cs:255-256`) then executes `await Controller.SB.TrainAsync(Controller.OlSelection, true)`, which throws `NullReferenceException`. Because the handler is `async void`, the exception surfaces on the message-pump synchronization context rather than at the call site.
+
+```text
+System.NullReferenceException: Object reference not set to an instance of an object.
+   at TaskMaster.RibbonViewer.TrainSpam_Click(IRibbonControl control)
+```
+
+### Verified root cause (file + line)
+
+| Fact | Location | Consequence |
+|---|---|---|
+| `InboxEngines` is initialized to an **empty** `ConcurrentDictionary` at field-initializer time | `TaskMaster\AppGlobals\AppItemEngines.cs:119-123` | The race window exists from add-in load until `InitAsync()` finishes. |
+| `InitAsync()` first awaits `Globals.AF.Manager.Configuration` | `TaskMaster\AppGlobals\AppItemEngines.cs:50` | The window is long enough to be reached by a user click. |
+| The whole `InboxEngines` property is assigned **once**, at the end, from `ToConcurrentDictionaryAsync(...)`; it is never incrementally filled | `TaskMaster\AppGlobals\AppItemEngines.cs:63-84` | Readiness transitions from "no keys" to "all keys" in a single reference assignment, so a per-key `TryGetValue` probe is precise and race-free. |
+| `InitAsync()` filters on `.Where(config => config.Value.Engine)` and drops null factory results | `TaskMaster\AppGlobals\AppItemEngines.cs:64`, `:83` | An engine that is configured off, or whose factory returned null, **never** enters the dictionary. |
+| `RestartEngineAsync(string)` re-assigns a single key | `TaskMaster\AppGlobals\AppItemEngines.cs:111-117` | Readiness for that key must be re-evaluated after a restart. |
+| No readiness signal is published, and `RibbonExplorer.xml` declares no `getEnabled` callback for the engine-backed buttons | `TaskMaster\Ribbon\RibbonExplorer.xml` | The ribbon cannot reflect initialization progress, so the controls stay clickable. |
+| `AppItemEngines` is `[ExcludeFromCodeCoverage]` at type level | `TaskMaster\AppGlobals\AppItemEngines.cs:26-27` | Any readiness logic placed on this class is uncoverable. |
+| `RibbonController` and `RibbonViewer` are `[ExcludeFromCodeCoverage]` at type level | `TaskMaster\Ribbon\RibbonController.cs:36`, `TaskMaster\Ribbon\RibbonViewer.cs:31-33` | Any readiness logic placed on these classes is likewise uncoverable. |
+
+### Verified defect surface — exactly 8 handlers
+
+Established by call-graph inspection of every ribbon callback (research §1.4). This is the corrected set; see `## Correction Log` entry 1.
+
+| # | Handler (`TaskMaster\Ribbon\RibbonViewer.cs`) | Dereference path | Engine key | Exception during window | Ribbon control id |
+|---|---|---|---|---|---|
+| 1 | `TrainSpam_Click` (255-256) | `Controller.SB.TrainAsync(...)` | `Spam` | `NullReferenceException` | `TrainSpam` |
+| 2 | `TrainHam_Click` (258-259) | `Controller.SB.TrainAsync(...)` | `Spam` | `NullReferenceException` | `TrainHam` |
+| 3 | `TestSpam_Click` (261-264) | `Controller.Engines.InboxEngines[SpamBayes.GroupName].Engine` (**indexer**) | `Spam` | **`KeyNotFoundException`** | `TestSpam` |
+| 4 | `TriageSetA_Click` (303-304) | `_controller.Triage.OlLogic.TrainSelectionAsync("A")` | `Triage` | `NullReferenceException` | `TriageSetA` |
+| 5 | `TriageSetB_Click` (306-307) | same, `"B"` | `Triage` | `NullReferenceException` | `TriageSetB` |
+| 6 | `TriageSetC_Click` (309-310) | same, `"C"` | `Triage` | `NullReferenceException` | `TriageSetC` |
+| 7 | `ClearTriage_Click` (316-317) | `_controller.Triage.OlLogic.UnTrainSelectionAsync()` | `Triage` | `NullReferenceException` | `ClearTriage` |
+| 8 | `FilterViewer_Click` (325-326) | `_controller.Triage.OlLogic.FilterViewAsync()` | `Triage` | `NullReferenceException` | `FilterTriageGroup` |
+
+Callbacks verified **already race-safe** and therefore explicitly out of scope: `ClearSpam_Click`, `SpamSaveNetwork_Click`, `SpamSaveLocal_Click`, `GetSaveLocation_Click`, `TriageSaveNetwork_Click`, `TriageSaveLocal_Click`, `TriageGetSaveLocation_Click` (all use `TryGetValue` and silently no-op), `SpamBayesEnabled_Click`, `TriageEnabled_Click`, `*_GetPressed` (read `Configuration`, not `InboxEngines`), `TriageSelection_Click`, `SetPrecision_Click`, `ResetTriage_Click` (use `TriageAsync`/a fresh `Triage`), `BuildCategoryClassifier_Click`, `BuildActionableClassifier_Click` (construct fresh classifier groups).
+
+---
+
+## Requirements (canonical numbering)
+
+The GitHub issue body contains no explicitly numbered requirements; the research artifact established the stable numbering below from `issue.md`'s own sections. **All downstream artifacts must use this mapping.** R1–R5 are the five requirements; R6 is the preservation constraint stated alongside R4.
+
+| Ref | Requirement (source text) | `issue.md` line |
+|---|---|---|
+| **R1** | "There is no published readiness signal on `AppItemEngines`/`IAppItemEngines`" — a readiness signal must be introduced | 66 |
+| **R2** | "the Explorer ribbon XML declares no `getEnabled` callback for the engine-backed buttons" — `getEnabled` wiring must be added | 66 |
+| **R3** | "Clicking a not-yet-ready command produces no exception" — click-handler guards, with a user-facing "still loading" indication instead of a silent failure | 33, 72 |
+| **R4** | "Do not change the async engine construction logic, config loading, or dictionary population order inside `AppItemEngines.InitAsync()`" | 78 |
+| **R5a** | "Unit coverage areas: readiness signal …; engine-readiness predicate; click-handler guards; `RibbonExplorer.xml` `getEnabled` wiring validated by the existing ribbon-XML regression suite" | 72 |
+| **R5b** | "Integration scenario to retest: click each engine-backed ribbon command immediately after add-in reload" | 73 |
+| **R5c** | "Manual verification notes: verify `Ribbon.InvalidateControl(...)`/`Invalidate()` refreshes the enabled state" | 74 |
+| **R6** | "Preserve existing `SB`/`TrainAsync` behavior once engines are loaded" | 79 |
+
+### Issue acceptance bullets
+
+| Ref | Bullet (source text) | `issue.md` line |
+|---|---|---|
+| **A1** | "Clicking a not-yet-ready command produces no exception" | 33 |
+| **A2** | "once `InitAsync()` completes, the commands become enabled and behave exactly as they do today" | 33 |
+| **A3** | "Integration scenario to retest: click each engine-backed ribbon command immediately after add-in reload; confirm no exception and confirm normal behavior after `InitAsync()` completes" | 73 |
+| **A4** | "Manual verification notes: verify `Ribbon.InvalidateControl(...)`/`Invalidate()` refreshes the enabled state once initialization finishes" | 74 |
+
+---
+
+## Scope & Non-Goals
+
+**In scope**
+
+- A per-engine-key readiness contract, computed from the existing `IAppItemEngines.InboxEngines` member, implemented in new host-neutral types.
+- `getEnabled` wiring on the eight engine-backed `<button>` elements in `TaskMaster\Ribbon\RibbonExplorer.xml`, plus the single Office-typed callback shim.
+- Defense-in-depth guards on the eight handlers listed above, so a click during the window is a no-op with a user-facing "still loading" indication.
+- A post-initialization ribbon refresh (`IRibbonUI.InvalidateControl` per control id) marshalled to the UI/STA thread.
+- A partial-class split of `RibbonViewer.cs` so no file breaches the 500-line cap.
+- Unit tests, coverage evidence, and a manual-verification checklist.
+
+**Out of scope / non-goals**
+
+- **No change to `AppItemEngines.InitAsync()`** — engine construction, config loading, and dictionary population order are untouched (R4). `TaskMaster\AppGlobals\AppItemEngines.cs` takes a **zero-line diff**.
+- **No change to `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs`** — zero-line diff. See *Design rationale* for why an interface member is rejected on the merits.
+- **No change to `SB`/`Triage`/`TrainAsync` behavior once engines are loaded** (R6). The enabled path executes byte-identical expressions.
+- No `IsInitialized` / `InitTask` coarse readiness flag. Rejected on correctness grounds, not convenience — see *Design rationale*.
+- No change to `TaskMaster\AppGlobals\ApplicationGlobals.cs`.
+- No splitting of `RibbonExplorer.xml` (already 519 lines before this change; the overage is pre-existing and the file is a declarative embedded UI resource, not production/test/script code).
+- No fix for the out-of-scope defects catalogued in research §9 (orphan `onAction` callbacks, invalid `getPressed` signatures, fire-and-forget `ToggleEngineAsync`, non-null-safe `RibbonController.Engines`). Each is to be promoted to its own issue.
+- No Outlook UI-automation harness. R5b and the visual half of R5c remain manual.
+
+**Explicitly excluded systems, integrations, datasets:** no live Outlook process, no live mail profile, no network, no filesystem, no temporary files in any automated test.
+
+---
+
+## Root Cause Analysis
+
+`InboxEngines` is an empty `ConcurrentDictionary` from field-initializer time until the single terminal assignment at the end of `InitAsync()` (`AppItemEngines.cs:63-84`). `InitAsync()` first awaits `Globals.AF.Manager.Configuration` (line 50) and then asynchronously constructs each engine, so the empty-dictionary window spans the whole configuration + construction period. Because neither `AppItemEngines` nor `IAppItemEngines` publishes a readiness signal, and because `RibbonExplorer.xml` declares no `getEnabled` callback for the engine-backed buttons, the ribbon renders those controls enabled throughout the window. Clicking one reaches an engine dereference — `null` via `RibbonController.SB`/`Triage`, or a missing-key indexer in `TestSpam_Click` — inside an `async void` handler, so the resulting `NullReferenceException` or `KeyNotFoundException` escapes onto the message-pump synchronization context unhandled.
+
+---
+
+## Proposed Fix
+
+### Design summary (what changes where)
+
+Introduce a **per-engine-key readiness signal computed from the existing `IAppItemEngines.InboxEngines` member**, implemented in four new host-neutral `internal sealed` types under `TaskMaster\Ribbon\` that are **deliberately NOT `[ExcludeFromCodeCoverage]`**. Wire them into the ribbon through one new Office-typed `getEnabled` shim on a new `RibbonViewer` partial, add `getEnabled="EngineCommand_GetEnabled"` to the eight engine-backed `<button>` elements, route the eight affected handlers through a gated runner whose lambda defers the engine dereference, and invalidate those eight control ids once from `ThisAddIn` after `LoadAsync` completes on the STA.
+
+This is research option **(c)**. It follows the `HookReadinessCoordinator` / `EngineInitTimingProbe` precedent already established in this repository: a host-neutral, unit-tested decision seam plus a thin, coverage-exempt COM/VSTO glue layer.
+
+### The readiness contract
+
+**Definition.** For an engine key `k`, `k` is *ready* if and only if all of the following hold:
+
+1. the engines accessor returns a non-null `IAppItemEngines`;
+2. `InboxEngines` on that instance is non-null;
+3. `InboxEngines.TryGetValue(k, out var e)` returns `true`;
+4. `e` is not null.
+
+String comparison is the `ConcurrentDictionary` default — **ordinal and case-sensitive** — so `"spam"` is not `"Spam"`. Readiness is recomputed on every query; it is never cached in the gate.
+
+**Why per-key and not global.** A coarse `IsInitialized`/`InitTask` flag is **incorrect on the merits**, not merely inconvenient:
+
+- `InitAsync()` filters on `config.Value.Engine` (`AppItemEngines.cs:64`) and drops null factory results (line 83). An engine that is configured off never enters the dictionary. A global "initialized" flag would report **ready** for a command that will never work, so the button would be enabled and the click would still throw. The coarse flag converts a timing bug into a permanent bug.
+- `RestartEngineAsync` (`AppItemEngines.cs:111-117`) re-assigns a single key. A one-shot flag cannot represent a per-key restart; a live per-key probe handles it automatically.
+- Setting a flag requires adding a statement inside `InitAsync()`, the method R4 fences off. The per-key probe requires a **zero-line diff** to `AppItemEngines.cs`.
+
+**State model.**
+
+| State | `InboxEngines` contents | `GetEnabled(id)` | Click behavior |
+|---|---|---|---|
+| S0 — pre-init | empty (field initializer) | `false` | no-op + one "still loading" indication; **no exception** |
+| S1 — init in flight | still empty (single terminal assignment) | `false` | as S0 |
+| S2 — init complete, engine present | key present, non-null | `true` | **unchanged from today** (R6) |
+| S3 — init complete, engine filtered out by config or null factory | key absent | `false` | no-op + indication; **no exception** |
+| S4 — engine restarted via `RestartEngineAsync` | key re-assigned | recomputed on next query | unchanged |
+| S5 — `InitAsync` threw | empty | `false` | no-op; fail-safe |
+
+**Invariants.**
+
+- The guard suppresses **invocation**, never **errors**. If the engine is ready and the action itself throws, the exception propagates (repo fail-fast rule). The guard must not become a swallow-all.
+- Unknown, null, or empty `control.Id` yields `false` — the callback must never disable a non-engine control it does not own.
+- The refresh is idempotent; a second refresh (for example after `RestartEngineAsync`) is harmless.
+
+### Design rationale — why not an interface member
+
+`IAppItemEngines` must not gain a member. .NET Framework 4.8.1 has **no default interface member support** (that CLR feature arrived in .NET Core 3.0; Roslyn reports `CS8701 Target runtime doesn't support default interface implementation` regardless of `LangVersion`). Any new interface member could therefore only be bodied inside `AppItemEngines`, which is `[ExcludeFromCodeCoverage]` at type level (`AppItemEngines.cs:26`). The new decision logic would be **entirely uncoverable** — exactly the substitution of a coverage attribute for a real testability seam that was rejected in the issue #227 precedent. Reading `InboxEngines`, which is already on the interface, needs no contract change at all.
+
+Secondary benefit, recorded for the planner: the test-double ripple is **zero**. No `Mock<IAppItemEngines>` site and no hand-rolled `IApplicationGlobals` double requires an edit.
+
+**Trade-off recorded.** The readiness contract is a convention over an existing member rather than a compiler-enforced interface member. Mitigation: the gate is the single chokepoint, it is `internal sealed`, and its semantics are pinned by unit tests.
+
+### Boundaries and invariants to preserve
+
+- `AppItemEngines.InitAsync()` engine construction, config loading, and dictionary population order: untouched (R4).
+- `RibbonController.SB` / `RibbonController.Triage` / `TrainAsync` behavior on the ready path: untouched (R6). Handlers keep the identical expression, relocated inside a lambda.
+- `[ComVisible(true)]` stays exactly where it is, on the existing `RibbonViewer`. A `partial` split adds no second attribute and no new COM-visible type.
+- No file may exceed 500 lines after the change.
+
+### Dependencies or blocked work
+
+None. No new NuGet package, no project reference change, no interface change, no test-double change. `[assembly: InternalsVisibleTo("TaskMaster.Test")]` already exists (`TaskMaster\ThisAddIn.cs:14`, `TaskMaster\Properties\AssemblyInfo.cs:38`), so the new `internal` types are directly testable.
+
+### Implementation strategy (what changes, not sequencing)
+
+#### New host-neutral types — all in `TaskMaster\Ribbon\`, all `internal sealed`, none `[ExcludeFromCodeCoverage]`
+
+Each type contains **zero** `Microsoft.Office.*` and zero `Microsoft.Office.Interop.Outlook` references, and is constructed from plain delegates so it is directly unit-testable with Moq.
+
+1. **`EngineCommandCatalog.cs`** — the single source of truth for the control-id to engine-key binding.
+   - `static bool TryGetEngineName(string controlId, out string engineName)` — ordinal lookup; `false` for null, empty, or unknown ids.
+   - `static IReadOnlyCollection<string> ControlIds { get; }` — exactly the eight ids from the defect-surface table.
+   - Rationale: this binding is shared by the XML, the `getEnabled` callback, the click guards, and the refresh. Centralizing it is what makes a single test able to assert XML/code agreement. The map is built to be extensible so a future `Project`/`Context`/`Actionable` command is a one-line addition.
+
+2. **`EngineReadinessGate.cs`** — the R1 readiness signal.
+   - `EngineReadinessGate(Func<IAppItemEngines> enginesAccessor)`; null accessor throws `ArgumentNullException` at construction (constructor-time invariant, per repo policy).
+   - `bool IsEngineReady(string engineName)` — implements the readiness contract above.
+   - `bool TryGetEngine(string engineName, out IConditionalEngine<MailItemHelper> engine)` — same predicate, returning the instance for callers that need it.
+
+3. **`EngineGatedCommandRunner.cs`** — the R3 click guard and the `getEnabled` decision.
+   - `EngineGatedCommandRunner(EngineReadinessGate gate, Action<string> notifyNotReady)`; null arguments throw `ArgumentNullException`.
+   - `bool IsCommandEnabled(string controlId)` → `EngineCommandCatalog.TryGetEngineName(controlId, out var name) && gate.IsEngineReady(name)`; `false` for unknown ids. This is the `getEnabled` decision.
+   - `Task RunAsync(string controlId, Func<Task> action)` — null `action` throws `ArgumentNullException`; when `!IsCommandEnabled(controlId)`, emit **exactly one** "still loading" notification and return a completed task **without invoking `action`**; otherwise `await action()` and let any exception propagate.
+   - The caller passes a **lambda**, so `Controller.SB` / `Controller.Triage` are dereferenced only *inside* the lambda and are never evaluated when the gate is closed. This is what converts the `NullReferenceException`/`KeyNotFoundException` into a no-op without scattering `?.` through `RibbonViewer`.
+
+4. **`EngineCommandRefreshPlanner.cs`** — the R5c refresh decision.
+   - `static void InvalidateAll(Action<string> invalidateControl)` — null delegate throws `ArgumentNullException`; invokes the delegate once per `EngineCommandCatalog.ControlIds` entry.
+   - Keeps "which controls to invalidate" coverable while `IRibbonUI.InvalidateControl` stays inside the exempt shim.
+
+#### Thin, uncovered shims (all inside types that are already `[ExcludeFromCodeCoverage]`)
+
+5. **`TaskMaster\Ribbon\RibbonController.EngineCommands.cs`** — new partial of the existing `[ExcludeFromCodeCoverage] partial class RibbonController`.
+   - Lazily builds `new EngineReadinessGate(() => Globals?.Engines)`. The `?.` is what makes the pre-`SetGlobals` case safe; note the existing `RibbonController.Engines` (`RibbonController.Intelligence.cs:204`) is **not** null-safe on `Globals` and must not be used as the accessor.
+   - Exposes `internal bool IsEngineCommandEnabled(string controlId)`, `internal Task RunEngineCommandAsync(string controlId, Func<Task> action)`, and `internal void RefreshEngineCommands()` forwarding to `_viewer`.
+   - Must **not** route through `RibbonController.SB`/`Triage` for the readiness decision: those getters side-effect a `WindowsFormsSynchronizationContext` onto the calling thread.
+
+6. **`TaskMaster\Ribbon\RibbonViewer.EngineCommands.cs`** — new partial; requires changing `public class RibbonViewer` to `public partial class RibbonViewer` at `RibbonViewer.cs:33`.
+   - `public bool EngineCommand_GetEnabled(Office.IRibbonControl control) => _controller?.IsEngineCommandEnabled(control?.Id) ?? false;` — the **only** new Office-typed surface introduced by this fix.
+   - `internal void InvalidateEngineCommands()` — no-op when `_ribbon` is null; marshals to `UtilitiesCS.Threading.UiThread.Dispatcher` when the current thread is not the dispatcher thread; then calls `EngineCommandRefreshPlanner.InvalidateAll(_ribbon.InvalidateControl)`.
+   - Hosts the relocated `#region Spam Manager` and `#region Triage` callbacks, rewritten in the shape
+     `public async void TrainSpam_Click(Office.IRibbonControl control) => await Controller.RunEngineCommandAsync("TrainSpam", () => Controller.SB.TrainAsync(Controller.OlSelection, true));`
+
+7. **`TaskMaster\Ribbon\RibbonViewer.cs`** — `class` becomes `partial class` (line 33); the `#region Spam Manager` and `#region Triage` blocks (lines 250-347) move into file 6. This is required, not cosmetic: the file is **487 lines against a 500-line cap**, so the new callbacks cannot be added in place. After the move it lands at roughly 389 lines.
+
+8. **`TaskMaster\Ribbon\RibbonExplorer.xml`** — add `getEnabled="EngineCommand_GetEnabled"` to the eight `<button>` elements listed in *Ribbon wiring* below.
+
+9. **`TaskMaster\ThisAddIn.cs`** — one refresh statement plus a why-comment after `await _globals.LoadAsync(false);` (line 76).
+
+10. **`TaskMaster\TaskMaster.csproj`** and **`TaskMaster.Test\TaskMaster.Test.csproj`** — `<Compile Include>` entries for the new files (legacy non-SDK projects require explicit includes).
+
+#### Ribbon wiring
+
+The eight `<button>` elements in `TaskMaster\Ribbon\RibbonExplorer.xml` that receive `getEnabled="EngineCommand_GetEnabled"`:
+
+| Control id | Element | Line | Parent |
+|---|---|---|---|
+| `TrainSpam` | `button` | 99-104 | `group id="SpamBayesGroup"` |
+| `TrainHam` | `button` | 105-110 | `group id="SpamBayesGroup"` |
+| `TestSpam` | `button` | 150-155 | `menu id="OtherSpamActions"` |
+| `TriageSetA` | `button` | 445 | `group id="TriageGroup"` |
+| `TriageSetB` | `button` | 446 | `group id="TriageGroup"` |
+| `TriageSetC` | `button` | 447 | `group id="TriageGroup"` |
+| `FilterTriageGroup` | `button` | 449-454 | `menu id="OtherTriageActions"` |
+| `ClearTriage` | `button` | 455-460 | `menu id="OtherTriageActions"` |
+
+Constraints on the wiring:
+
+- **Do not** put `getEnabled` on `menu id="OtherSpamActions"` or `menu id="OtherTriageActions"`. Those menus also contain save-location, folder-settings, and enable-toggle commands that are safe and useful during initialization; disabling the container would over-restrict the UI.
+- **Do not** attempt `group`- or `tab`-level disabling. The CustomUI schema exposes `getVisible` but **not** `getEnabled` on `group` and `tab`.
+- The root element uses the 2009 (`customUI14`) namespace (`RibbonExplorer.xml:2`); XML assertions must be namespace-aware.
+- CSharpier is file-based and formats `*.cs` only. The XML must be hand-edited to match the surrounding one-attribute-per-line style.
+
+**Required VSTO callback signature.** `bool GetEnabled(Office.IRibbonControl control)` — a `public` instance method whose name matches the XML attribute value exactly. VSTO silently ignores signature mismatches: a wrong signature compiles and nothing happens when the user clicks or when Office queries the control. One callback may serve many controls, dispatching on `control.Id`; that is the documented pattern and is what `EngineCommand_GetEnabled` does.
+
+**Refresh after initialization is load-bearing.** Office caches each callback's response per control until the add-in invalidates it. Without an explicit invalidation the eight buttons remain disabled for the entire session even after `InitAsync()` succeeds. `IRibbonUI.InvalidateControl(controlId)` invalidates one control; `IRibbonUI.Invalidate()` invalidates every control's cached values. This fix uses `InvalidateControl` once per catalog id (via `EngineCommandRefreshPlanner.InvalidateAll`) so it never disturbs unrelated controls' cached state; `Invalidate()` is the documented fallback if a control id proves unreachable.
+
+**UI/STA marshalling requirement.** `IRibbonUI` is an Office COM object handed to `Ribbon_Load` on the STA and must be called back on the STA. `InitAsync()` is launched via `Task.Run` (`ApplicationGlobals.cs:417`) and therefore *completes* on a thread-pool thread; only an awaiting continuation is marshalled back, and only when a synchronization context was captured. In the live startup path (`ThisAddIn.Application_Startup` enqueues `LoadAsync(false)` with `useUiThread: true`, and `IdleAsyncQueue` runs it through `UiThread.Dispatcher`) the continuation does resume on the STA — but `LoadWhenIdle()` enqueues with `useUiThread: false` and `LoadParallelAsync()` inherits its caller's context. The refresh must therefore be **explicitly marshalled through `UtilitiesCS.Threading.UiThread.Dispatcher`** inside `InvalidateEngineCommands()`, not left to the ambient context.
+
+#### Defense-in-depth: click-handler guards and the "still loading" indication (R3)
+
+`getEnabled` alone is not sufficient. Office's callback caching means a control can be visually enabled while the underlying engine is absent (for example between an engine restart and the next invalidation), and a signature mismatch would silently disable the wiring entirely. Each of the eight handlers is therefore also routed through `EngineGatedCommandRunner.RunAsync`, which re-checks readiness at click time and defers the engine dereference into the lambda.
+
+When the gate is closed, the runner emits exactly one notification through its injected `Action<string>` sink, carrying the control id and the engine key. The sink is the seam: the **decision** to notify and the **content** of the notification are host-neutral and unit-tested, while the **presentation** (status text / non-modal indication that the engine is still loading) lives in the coverage-exempt `RibbonViewer` shim. Automated tests assert on the injected sink and never construct a `Form` or `MessageBox`.
+
+#### Error handling and logging updates
+
+- Skipped clicks produce a single structured notification line; they never throw.
+- Errors thrown by the action on the ready path propagate unchanged. No new `catch (Exception)` is introduced.
+- Constructor preconditions throw `ArgumentNullException`. No `Debug.Assert` is used for user-facing validation.
+
+#### Rollback / feature-flag considerations
+
+None required. The change is additive plus a mechanical partial-class split. Rollback is a straight revert; `AppItemEngines.cs` and `IAppItemEngines.cs` are not touched, so no data or contract migration is involved.
+
+### Technical specifications (interfaces/contracts)
+
+#### Inputs / outputs and formats
+
+| Member | Input | Output | Failure mode |
+|---|---|---|---|
+| `EngineCommandCatalog.TryGetEngineName` | `string controlId` (ordinal) | `bool` + `out string engineName` | `false` + `null` for null/empty/unknown |
+| `EngineCommandCatalog.ControlIds` | — | `IReadOnlyCollection<string>` of exactly 8 ids, no duplicates | — |
+| `EngineReadinessGate.IsEngineReady` | `string engineName` (ordinal, case-sensitive) | `bool` | `false` for null/whitespace, null accessor result, null `InboxEngines`, missing key, null value |
+| `EngineReadinessGate.TryGetEngine` | `string engineName` | `bool` + `out IConditionalEngine<MailItemHelper>` | `false` + `null` |
+| `EngineGatedCommandRunner.IsCommandEnabled` | `string controlId` | `bool` | `false` for unknown id |
+| `EngineGatedCommandRunner.RunAsync` | `string controlId`, `Func<Task> action` | `Task` | `ArgumentNullException` on null action; action exceptions propagate |
+| `EngineCommandRefreshPlanner.InvalidateAll` | `Action<string> invalidateControl` | `void` | `ArgumentNullException` on null delegate |
+| `RibbonViewer.EngineCommand_GetEnabled` | `Office.IRibbonControl control` | `bool` | `false` when `_controller` or `control` is null |
+
+#### Required configuration keys and defaults
+
+None. No new configuration key, no new default. Existing engine configuration (`config.Value.Engine`) is read only indirectly, through the presence or absence of a dictionary key.
+
+#### Backward-compatibility expectations
+
+- `IAppItemEngines` is unchanged, so every implementer and test double compiles unmodified.
+- Every existing ribbon control keeps its current behavior; only the eight engine-backed buttons gain a `getEnabled` attribute.
+- The ready-path behavior of all eight handlers is byte-identical to today's.
+
+#### Performance constraints
+
+`IsEngineReady` is one `ConcurrentDictionary.TryGetValue` plus null checks — O(1), lock-free, allocation-free. `getEnabled` is queried by Office on ribbon paint and after invalidation, at human-interaction frequency. No measurable latency, throughput, or memory impact is expected, and no performance budget is imposed.
+
+### Architecture-boundaries compliance
+
+Assessed against `.claude/rules/architecture-boundaries.md`. No enforcement stage exists in this repository today (there is no `*.ArchitectureTests` project and no `quality-tiers.yml` at repo root), and the rule text itself qualifies the .NET assertions with "when the backend exists". The work is nevertheless compliant in substance:
+
+- **Rule 3 (`[ComVisible(true)]` banned in new production code):** no new COM-visible type. The attribute stays on the existing `RibbonViewer`; a `partial` split does not add a second attribute.
+- **Rules 1, 2, 4 (VSTO / Outlook Interop / desktop ribbon callbacks):** the only new Office-typed member is exactly one method, `public bool EngineCommand_GetEnabled(Office.IRibbonControl)`, inside the pre-existing COM-visible, coverage-exempt `RibbonViewer` shim. All four new decision types carry **zero** `Microsoft.Office.*` and `Microsoft.Office.Interop.Outlook` using directives.
+- **Rule 8 (behavior in host-neutral modules):** all readiness, catalog, guard, and refresh-planning logic is host-neutral and portable unchanged if the desktop ribbon is later replaced by an Office.js command surface. Only the shim would be rewritten.
+
+---
+
+## Assumptions, Constraints, Dependencies
+
+**Assumptions**
+
+- `ConcurrentDictionary.TryGetValue` is thread-safe and `InitAsync` performs a single whole-dictionary reference assignment, so a probe never observes a partially populated map.
+- `InternalsVisibleTo("TaskMaster.Test")` remains in place.
+- `UtilitiesCS.Threading.UiThread.Dispatcher` is available and represents the STA on which `Ribbon_Load` received the `IRibbonUI`.
+
+**Constraints**
+
+- .NET Framework 4.8.1 — no default interface members.
+- 500-line cap for every production, test, and reusable script file. `RibbonViewer.cs` is at 487/500 and `RibbonController.Intelligence.cs` at 412/500 before the change.
+- `TaskMaster.csproj` declares no `<Nullable>` element, but the type-check gate runs `/p:Nullable=enable /p:TreatWarningsAsErrors=true`. New files must be nullable-clean under that global override. Use guard clauses and `?? throw new ArgumentNullException(...)` in the `HookReadinessCoordinator` style rather than a scoped `#nullable enable annotations` pragma.
+- `Thread.Sleep` and `Task.Delay` are banned (`BannedSymbols.txt`); no wall-clock reads, no temporary files, no message pump, no live COM in tests.
+- `RibbonExplorer.xml` is already 519 lines before this change. The overage is pre-existing and is recorded, not remediated here.
+
+**External dependencies**
+
+MSTest, Moq, FluentAssertions only — all already referenced. No new package.
+
+---
+
+## Data / API / Config Impact
+
+- **User-facing changes:** the eight engine-backed ribbon buttons appear disabled until their backing engine is loaded, and become enabled once initialization completes. A click that still reaches a closed gate produces a "still loading" indication instead of an unhandled exception.
+- **API changes:** none to any public cross-project contract. Four new `internal sealed` types and one new `public` COM callback method on the existing `RibbonViewer`.
+- **Data or migration:** none.
+- **Logging/telemetry:** one structured skip notification per blocked click, carrying the control id and the engine key. No existing log statement is changed or removed.
+- **Compatibility notes:** no CLI flag, config schema, or version change.
+
+---
+
+## Test Strategy
+
+Framework: **MSTest** (`[TestClass]`/`[TestMethod]`) + **Moq** + **FluentAssertions**, Arrange–Act–Assert. Every automated test is deterministic and uses **no** temporary files, **no** `Thread.Sleep`/`Task.Delay`, **no** wall-clock reads, **no** real WinForms message pump, **no** `Form` or `MessageBox`, and **no** live COM or Outlook process. `IConditionalEngine<MailItemHelper>` is mockable via `new Mock<IConditionalEngine<MailItemHelper>>().Object`.
+
+Tests must not reach the readiness decision through `RibbonController.SB`/`Triage`/`TriageAsync`: those getters install a real `WindowsFormsSynchronizationContext` on the calling thread as a side effect.
+
+### `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs` (R1, R5a)
+
+Covers states S0–S5: accessor returns null; `InboxEngines` empty (**the #503 repro window**); key present with non-null engine; key present with null value; null/whitespace engine name; ordinal case sensitivity (`"spam"` vs `"Spam"`); dictionary mutated between two calls on the same instance (models the S1→S2 transition and `RestartEngineAsync` with no timing dependency); `TryGetEngine` ready/not-ready; constructor null-accessor `ArgumentNullException`.
+
+### `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs` (R2, R5a)
+
+Data-driven mapping for all eight control ids to their engine keys; unknown id; null id; `ControlIds` equals exactly the eight ids; `ControlIds` contains no duplicates.
+
+### `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs` (R3, R6, R5a)
+
+`RunAsync` when not ready does not invoke the action and does not throw (**the primary #503 regression test**); emits exactly one notification containing the control id and engine key; when ready invokes the action exactly once (R6); awaits the action to completion using a `TaskCompletionSource` completed synchronously by the test; propagates an exception thrown by a ready action (fail-fast, not swallow-all); unknown control id does not invoke the action; null action throws `ArgumentNullException`; `IsCommandEnabled` returns `false` when not ready, `true` when ready, `false` for an unknown id.
+
+### `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs` (R5c, R5a)
+
+`InvalidateAll` invokes the delegate once per catalog id, asserted as **set** equality against `EngineCommandCatalog.ControlIds` — never as an ordered sequence, because Office documents callback ordering as unspecified; null delegate throws `ArgumentNullException`.
+
+### `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` additions (R2, R5a)
+
+Parses the embedded resource `TaskMaster.Ribbon.RibbonExplorer.xml` via `GetManifestResourceStream` with `XDocument` (existing pattern; no Outlook, no filesystem). New assertions: every catalog control id exists in the XML and carries `getEnabled="EngineCommand_GetEnabled"`; no other element carries that value (guards against over-disabling); every catalog id resolves to a schema-legal element type for `getEnabled` (`button`), never `group`/`tab`; and a reflection assertion that `typeof(RibbonViewer)` exposes a `public` instance method named `EngineCommand_GetEnabled` returning `bool` with exactly one parameter of type `Microsoft.Office.Core.IRibbonControl` — the guard against the documented "wrong signature compiles but silently does nothing" failure mode.
+
+### Deliberately not unit-tested, and why
+
+`RibbonViewer.EngineCommand_GetEnabled`, `RibbonViewer.InvalidateEngineCommands`, the `RibbonController` engine-command shims, and the `ThisAddIn` refresh call all live in `[ExcludeFromCodeCoverage]` types and consist of null checks plus one delegating call each. This is the ratified COM/VSTO/WinForms exemption in CLAUDE.md § UT2 applied to **thin wiring only**; every decision is covered. This is the distinction required by the issue #227 precedent.
+
+### Coverage targets and evidence
+
+- The four new types must reach **>= 90% line coverage** (CLAUDE.md § UT2 new-module floor, the stricter of the applicable thresholds). This is achievable because they contain no host-bound code.
+- No coverage regression on changed lines.
+- Baseline coverage XML must be captured at the merge-base under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/baseline/` **before** implementation; final coverage XML under `.../evidence/qa-gates/`; the comparison recorded alongside. No baseline exists at spec authoring time, so the repo-wide figure is a record-and-report obligation measured against that captured baseline, not an absolute pass/fail floor imposed by this change (see AC24).
+- Manual-verification outcomes recorded under `.../evidence/manual-verification/`.
+
+### Toolchain commands (format → lint → type-check → test)
+
+1. `dotnet tool run csharpier .`
+2. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`
+3. `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+4. `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage`
+
+Restart from step 1 if any step fails or changes files.
+
+### Manual validation (cannot be automated in this repository)
+
+There is no Outlook UI-automation harness in this repository, and the general unit-test policy prohibits tests that depend on external processes. The following are executed by the maintainer against a live Outlook profile and recorded under `.../evidence/manual-verification/`:
+
+1. Reload the add-in and, during initialization, click each of the eight engine-backed commands. Confirm no `NullReferenceException` and no `KeyNotFoundException` in the log, and that a "still loading" indication appears.
+2. Confirm Office visually greys the eight buttons during initialization.
+3. After initialization completes, confirm the eight buttons become enabled without an add-in restart (this is what proves the `InvalidateControl` refresh fired and that the callback is actually bound — VSTO silently ignores signature mismatches, so only a live load proves binding).
+4. Confirm each of the eight commands behaves exactly as before once enabled.
+
+---
+
+## Acceptance Criteria
+
+Traceability tags: `R1`-`R6` are the requirements table above; `A1`-`A4` are the issue acceptance bullets. Criteria marked **MANUAL-ONLY** must **never** be checked off on the strength of unit tests; they require recorded live-Outlook verification.
+
+- [x] **AC1 (R1)** `TaskMaster\Ribbon\EngineReadinessGate.cs` exists, is `internal sealed`, carries no `[ExcludeFromCodeCoverage]` attribute, contains zero `Microsoft.Office.*` using directives, and implements the per-key readiness contract (non-null accessor result, non-null `InboxEngines`, key present, value non-null). Verified by `TaskMaster.Test\Ribbon\EngineReadinessGateTests.cs`.
+- [x] **AC2 (R1)** `EngineReadinessGate.IsEngineReady` returns `false` for a null accessor result, a null `InboxEngines`, an empty dictionary (the #503 window), a missing key, a null dictionary value, and a null/whitespace engine name; and is ordinal case-sensitive (`"spam"` is not `"Spam"`). Verified by named tests in `EngineReadinessGateTests`.
+- [x] **AC3 (R1)** Readiness is recomputed on every query, so a key added or replaced after the first query (models the S1→S2 transition and `RestartEngineAsync`) flips the result without any restart or timing dependency. Verified by a test that mutates the same `ConcurrentDictionary` between two calls, with no `Thread.Sleep`/`Task.Delay`.
+- [x] **AC4 (R1)** `EngineReadinessGate` throws `ArgumentNullException` from its constructor when the engines accessor is null. Verified by `Constructor_WithNullAccessor_ThrowsArgumentNullException`.
+- [x] **AC5 (R2)** All eight engine-backed `<button>` elements in `TaskMaster\Ribbon\RibbonExplorer.xml` (`TrainSpam`, `TrainHam`, `TestSpam`, `TriageSetA`, `TriageSetB`, `TriageSetC`, `FilterTriageGroup`, `ClearTriage`) declare `getEnabled="EngineCommand_GetEnabled"`. Verified by a namespace-aware `XDocument` assertion over the embedded resource in `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs`.
+- [x] **AC6 (R2)** No element other than those eight declares `getEnabled="EngineCommand_GetEnabled"`, so the fix cannot silently over-disable the UI; in particular `menu id="OtherSpamActions"`, `menu id="OtherTriageActions"`, and every `group`/`tab` element are unmodified. Verified by a negative assertion in `RibbonExplorerXmlTests`.
+- [x] **AC7 (R2)** Every catalog control id resolves in the XML to an element type for which the CustomUI schema permits `getEnabled` (`button`), never `group` or `tab`. Verified by a schema-legality assertion in `RibbonExplorerXmlTests`.
+- [x] **AC8 (R2)** `RibbonViewer` exposes a `public` instance method `EngineCommand_GetEnabled` returning `bool` with exactly one parameter of type `Microsoft.Office.Core.IRibbonControl`, matching the required VSTO callback signature `bool GetEnabled(Office.IRibbonControl control)`. Verified by a reflection assertion in `RibbonExplorerXmlTests`.
+- [x] **AC9 (R2)** `EngineCommandCatalog` maps exactly the eight control ids to their engine keys (`Spam` x3, `Triage` x5), returns `false` for null/empty/unknown ids, and exposes a duplicate-free `ControlIds` collection of exactly those eight ids. Verified by `TaskMaster.Test\Ribbon\EngineCommandCatalogTests.cs`.
+- [x] **AC10 (R3, A1)** All eight affected handlers (`TrainSpam_Click`, `TrainHam_Click`, `TestSpam_Click`, `TriageSetA_Click`, `TriageSetB_Click`, `TriageSetC_Click`, `ClearTriage_Click`, `FilterViewer_Click`) invoke their engine dereference only inside a lambda passed to `EngineGatedCommandRunner.RunAsync`, so no engine is dereferenced when the gate is closed. Verified by source inspection plus `RunAsync_WhenEngineNotReady_DoesNotInvokeAction` in `TaskMaster.Test\Ribbon\EngineGatedCommandRunnerTests.cs`.
+- [x] **AC11 (R3, A1)** `EngineGatedCommandRunner.RunAsync` completes without throwing when the engine is not ready, covering both reported exception types: `NullReferenceException` (the `Controller.SB`/`Controller.Triage` path) and `KeyNotFoundException` (the `TestSpam_Click` dictionary-indexer path). This is the primary regression test for #503.
+- [x] **AC12 (R3)** A blocked click emits exactly one user-facing "still loading" notification through the injected `Action<string>` sink, containing the control id and the engine key. Verified by `EngineGatedCommandRunnerTests` asserting on the injected sink, with no `Form`, `MessageBox`, or message pump constructed in the test.
+- [x] **AC13 (R3)** `RunAsync` throws `ArgumentNullException` for a null action, and does not invoke the action for an unknown control id. Verified by named tests.
+- [x] **AC14 (R3)** The guard suppresses invocation but never errors: when the engine is ready and the action throws, the exception propagates unchanged. Verified by `RunAsync_WhenActionThrows_PropagatesException`. No new `catch (Exception)` is introduced anywhere in the change.
+- [x] **AC15 (R4)** `TaskMaster\AppGlobals\AppItemEngines.cs` and `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs` each show a **zero-line diff** against the merge-base. Verified by `git diff --numstat <merge-base>..HEAD` reporting neither path. No `IsInitialized`/`InitTask` flag and no new `IAppItemEngines` member is introduced.
+- [x] **AC16 (R6, A2)** On the ready path the eight handlers execute expressions identical to today's (for example `Controller.SB.TrainAsync(Controller.OlSelection, true)`), and `RunAsync` invokes the supplied action exactly once and awaits it to completion. Verified by `RunAsync_WhenEngineReady_InvokesActionExactlyOnce` and `RunAsync_WhenEngineReady_AwaitsActionToCompletion` (driven by a synchronously completed `TaskCompletionSource`), plus source diff review of the eight handlers.
+- [x] **AC17 (R5c, A4)** `EngineCommandRefreshPlanner.InvalidateAll` invokes the supplied invalidation delegate once for each of the eight catalog control ids, asserted as **set** equality (not sequence order, because Office documents callback ordering as unspecified), and throws `ArgumentNullException` for a null delegate. Verified by `TaskMaster.Test\Ribbon\EngineCommandRefreshPlannerTests.cs`.
+- [x] **AC18 (R5c, A4)** `RibbonViewer.InvalidateEngineCommands()` no-ops when `_ribbon` is null and explicitly marshals the `IRibbonUI` call to `UtilitiesCS.Threading.UiThread.Dispatcher` rather than relying on the ambient synchronization context; `ThisAddIn` invokes the refresh exactly once after `await _globals.LoadAsync(false)`. Verified by source inspection of the shim and the call site (both are in `[ExcludeFromCodeCoverage]` types by design).
+- [ ] **AC19 (R5b, A3) — MANUAL-ONLY.** In a live Outlook Explorer, immediately after add-in reload and before initialization completes, each of the eight engine-backed ribbon commands is clicked and produces no `NullReferenceException` and no `KeyNotFoundException` in the log, and shows the "still loading" indication. Requires a running Outlook process and a live mail profile; **must not be checked off on the strength of unit tests.** Outcome recorded under `docs/features/active/2026-08-08-ribbon-engine-readiness-guard-503/evidence/manual-verification/`.
+- [ ] **AC20 (R5b, A2, A3) — MANUAL-ONLY.** In the same live session, after `InitAsync()` completes, each of the eight commands behaves exactly as it did before this change. Requires live Outlook; outcome recorded under `.../evidence/manual-verification/`.
+- [ ] **AC21 (R5c, A4) — MANUAL-ONLY.** In a live Outlook session, Office visually greys the eight buttons during initialization and re-enables them after the post-`InitAsync()` invalidation fires, without an add-in restart. This also confirms the `getEnabled` callback is actually bound, which VSTO does not report on a signature mismatch. Office's callback-caching behavior is internal to the host and is not locally observable; **must not be checked off on the strength of unit tests.** Outcome recorded under `.../evidence/manual-verification/`.
+- [x] **AC22 (R5a)** `dotnet tool run csharpier .` reports no formatting changes; `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true` completes with zero errors and no new analyzer diagnostics; `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true` completes with zero errors; `vstest.console.exe <test-assembly-paths> /EnableCodeCoverage` reports zero failed and zero skipped tests. All four steps pass in a single uninterrupted pass, and the artifacts are recorded under `.../evidence/qa-gates/`.
+- [x] **AC23 (R5a)** Each of the four new types (`EngineCommandCatalog`, `EngineReadinessGate`, `EngineGatedCommandRunner`, `EngineCommandRefreshPlanner`) reaches **>= 90% line coverage** in the final coverage XML under `.../evidence/qa-gates/`.
+- [x] **AC24 (R5a)** A merge-base coverage baseline is captured under `.../evidence/baseline/` before implementation, and the post-change coverage figure is compared against it. The comparison shows no regression on changed lines and no reduction in the repository line-coverage figure on the testable denominator defined in CLAUDE.md § UT2. The absolute repo-wide figure is recorded and reported in the comparison artifact; it is not restated here as an independent numeric floor, because no baseline existed at spec authoring time.
+- [x] **AC25** Every file touched by this change is at or under **500 lines** after the change, verified by a line count of each path in the branch diff. This specifically requires the `RibbonViewer.cs` partial-class split (487/500 before the change, so the new callbacks cannot be added in place) with the `#region Spam Manager` and `#region Triage` blocks relocated into `RibbonViewer.EngineCommands.cs`. `RibbonExplorer.xml` (519 lines, pre-existing overage, declarative embedded UI resource) is recorded as an accepted pre-existing exception and is not remediated here.
+- [x] **AC26** No `[ExcludeFromCodeCoverage]` attribute is added to any new type carrying readiness decision logic. Verified by grepping the four new files for the attribute and finding zero occurrences.
+- [x] **AC27** The only new `Microsoft.Office.*`-typed member introduced by this change is `public bool EngineCommand_GetEnabled(Office.IRibbonControl control)` on the pre-existing `[ComVisible(true)] [ExcludeFromCodeCoverage] RibbonViewer`. No new `[ComVisible(true)]` type is added, and the four new decision types contain zero `Microsoft.Office.*` and zero `Microsoft.Office.Interop.Outlook` using directives (`.claude/rules/architecture-boundaries.md` rules 1-4 and 8). Verified by grep over the new and changed files.
+- [x] **AC28** No automated test in this change creates a temporary file, calls `Thread.Sleep` or `Task.Delay`, reads the wall clock, constructs a `Form` or `MessageBox`, starts a WinForms message pump, or touches live COM/Outlook. Verified by grep over the new and changed test files plus the `BannedSymbols.txt` analyzer result in the AC22 build.
+- [x] **AC29** The out-of-scope defects catalogued in research §9 (orphan `onAction` callbacks, invalid `getPressed` signatures, fire-and-forget `ToggleEngineAsync`, non-null-safe `RibbonController.Engines`) are each promoted to a separate GitHub issue through the promotion lifecycle, and none is fixed inside #503. Verified by the recorded promotion receipts.
+- [x] **AC30** This spec, `issue.md`, and the plan reflect the delivered outcome, including any deviation from the design recorded here, and the manual-verification checklist for AC19-AC21 is present in the feature folder with its outcomes recorded.
+
+---
+
+## Risks & Mitigations
+
+| Risk | Impact | Mitigation |
+|---|---|---|
+| VSTO silently ignores a `getEnabled` signature mismatch — the wiring compiles and does nothing | Buttons never disable; the bug persists undetected | AC8 reflection test pins the exact signature; AC21 live check proves binding; the AC10 click guard makes the fix correct even if the callback never binds |
+| Office caches `getEnabled` responses per control until invalidated | Buttons stay disabled for the whole session after initialization succeeds | AC17 covers the invalidation set; AC18 pins the single refresh call site; AC21 confirms it live |
+| `IRibbonUI` called off the STA | COM failure or silent no-op at runtime | AC18 requires explicit marshalling through `UiThread.Dispatcher` rather than relying on the ambient context |
+| `RibbonViewer.cs` breaches the 500-line cap | Blocking policy violation | AC25 requires the partial-class split with region relocation, which nets the file down to roughly 389 lines |
+| The guard degenerates into a swallow-all and hides real engine errors | Silent failures worse than the original bug | AC14 requires exception propagation on the ready path and forbids new broad catches |
+| Readiness treated as global rather than per-key | An engine configured off would report ready and still throw | The readiness contract is per-key by construction; AC2 pins the missing-key and null-value cases |
+| Over-disabling by putting `getEnabled` on menus or groups | Safe commands (save location, folder settings, enable toggles) become unusable during initialization | AC6 asserts no element other than the eight carries the callback; AC7 asserts schema legality |
+| Scope creep into the research §9 defects | Larger, riskier diff; the bugfix workflow requires a minimal targeted fix | AC29 requires separate issue promotion instead of in-scope fixes |
+
+---
+
+## Rollout & Follow-up
+
+- **Release/rollout:** ships with the next add-in build. No configuration change, no migration, no feature flag. Rollback is a straight revert.
+- **Post-fix verification:** execute the AC19-AC21 manual checklist against a live Outlook profile and record the outcome under `.../evidence/manual-verification/` before merge.
+- **Follow-up work:** promote each research §9 defect to its own issue (AC29). Optionally evaluate whether the existing `TaskMaster.Test\AppGlobals\LiveOutlookHarnessRunner.cs` harness can be extended to drive ribbon callbacks; this was not assessed in depth, would still require a live Outlook process, and is not a recommendation for this fix.
+- **Links:** issue <https://github.com/drmoisan/TaskMaster/issues/503>; research `research/2026-08-08T12-45-ribbon-engine-readiness-guard-research.md`; branch `bug/ribbon-engine-readiness-guard-503`.
+
+---
+
+## Correction Log
+
+### 2026-08-08 — corrections applied to `issue.md` on the authority of the research artifact
+
+1. **Affected handler set narrowed to a verified 8.** `issue.md:16` states: *"The same initialization race affects every ribbon command backed by an engine in `InboxEngines` (Triage, Project, Context, Actionable)."* This is **false** for `Project`, `Context`, and `Actionable`. Call-graph inspection of every ribbon callback found that **no ribbon callback dereferences those engines**: `BuildCategoryClassifier_Click` (`RibbonViewer.cs:242-243`) and `BuildActionableClassifier_Click` (`RibbonViewer.cs:245-246`) construct fresh `CategoryClassifierGroup`/`ActionableClassifierGroup` instances via `RibbonController.BuildCategoryClassifierAsync`/`BuildActionableClassifierAsync` (`RibbonController.Intelligence.cs:119-137`) and never read `InboxEngines`. The verified defect surface is exactly the eight handlers in *Verified defect surface* above: `Spam` x3 and `Triage` x5. The catalog is nevertheless built as an extensible map so a future `Project`/`Context`/`Actionable` command is a one-line addition.
+
+2. **`TestSpam_Click` throws `KeyNotFoundException`, not `NullReferenceException`.** `issue.md` frames the defect as a `NullReferenceException` throughout, and mentions `TestSpam_Click` only in *Suspected Cause / Notes* (line 68). `TestSpam_Click` (`RibbonViewer.cs:261-264`) uses the dictionary **indexer** `Controller.Engines.InboxEngines[SpamBayes.GroupName]`, which throws `KeyNotFoundException` during the same window. Both exception types are in scope and both are named in AC11.
+
+3. **The readiness signal is not added to `AppItemEngines`/`IAppItemEngines`.** `issue.md:66` and `issue.md:72` phrase R1 and R5a as a "readiness signal on `AppItemEngines`/`IAppItemEngines`". That placement is rejected: .NET Framework 4.8.1 has no default interface members, so any new interface member could only be bodied inside the `[ExcludeFromCodeCoverage]` `AppItemEngines` class and would be entirely uncoverable. R1 is instead satisfied by a first-class, named, unit-tested `EngineReadinessGate` that reads the already-published `IAppItemEngines.InboxEngines` member, giving both files a zero-line diff (AC15) and a stronger R4 compliance than the original phrasing would have permitted.
+
+4. **A coarse `IsInitialized`/`InitTask` flag is rejected on correctness, not convenience.** `InitAsync` filters on `config.Value.Engine` (`AppItemEngines.cs:64`), so an engine that is configured off never enters the dictionary; a global "initialized" flag would report ready for a command that will never work, leaving the button enabled and the click still throwing. It also cannot represent `RestartEngineAsync` re-assigning a single key.
+
+5. **`RibbonExplorer.xml` scope.** `issue.md` implies XML edits only. The file is 519 lines before the change (already above the 500-line guidance). The overage is pre-existing, the file is a declarative embedded UI resource rather than production/test/script code, and splitting it is a separate and larger change. Recorded as an accepted pre-existing exception in AC25 rather than remediated here.
+
+---
+
+## Delivery Notes and Deviations
+
+Delivered 2026-08-08 on branch `bug/ribbon-engine-readiness-guard-503` against merge-base `003c5715055d7d1933db68a742531332756e30b2`, per plan `plan.2026-08-08T11-59.md`.
+
+### What shipped
+
+Four new host-neutral `internal` types under `TaskMaster\Ribbon\`, none marked `[ExcludeFromCodeCoverage]`, each at **100% line coverage**: `EngineCommandCatalog`, `EngineReadinessGate`, `EngineGatedCommandRunner`, `EngineCommandRefreshPlanner`. Two new thin partials inside the pre-existing coverage-exempt shims (`RibbonController.EngineCommands.cs`, `RibbonViewer.EngineCommands.cs`), `getEnabled="EngineCommand_GetEnabled"` on the eight engine-backed `<button>` elements, one post-initialization refresh in `ThisAddIn.cs`, and the `RibbonViewer.cs` partial-class split (487 to 388 lines). 45 new tests; suite 6293 to 6338, zero failed, zero skipped. `AppItemEngines.cs`, `IAppItemEngines.cs`, and `ApplicationGlobals.cs` each took a zero-line diff.
+
+### Deviation 1 — notification presentation (design decision D3, section 5.6 of the plan)
+
+The spec's parenthetical "non-modal indication" is aspirational. **The repository has no non-modal notification surface**, and introducing one is scope creep for a bug fix. The injected sink is therefore implemented in the `[ExcludeFromCodeCoverage]` `RibbonController.NotifyEngineCommandNotReady` shim as one `logger.Warn(message)` plus one `MessageBox.Show(message)`, matching the established user-facing notice mechanism already used at `RibbonViewer.cs:413`, `RibbonController.cs:80,167,189,196`, and `RibbonController.FolderTree.cs:250,263`.
+
+The binding criterion AC12 requires only that exactly one notification is emitted through the injected `Action<string>` sink carrying the control id and the engine key, which is fully unit-tested by `RunAsync_WhenEngineNotReady_EmitsExactlyOneNotificationContainingControlIdAndEngineName`. No test constructs a `Form`, a `MessageBox`, or a message pump.
+
+### Deviation 2 — CSharpier was scoped, not repo-wide, for the mutating pass (plan section 3 rule 5, decision D4)
+
+`csharpier format` was invoked only with the thirteen scope-locked `.cs` paths and **never** repo-wide, and never with `AppItemEngines.cs` or `IAppItemEngines.cs` in its argument list. Rationale: a repo-wide `csharpier format .` would reformat any file that is unformatted at the merge-base, which would break the AC15 zero-line-diff requirement. The read-only repo-wide `csharpier check .` gate was still run and returned exit 0 over 1498 files (1488 at the merge-base; the difference is exactly the ten new `.cs` files). This makes the AC15 guarantee structural rather than dependent on a measurement taken at plan time.
+
+### Deviation 3 — `UiThread` namespace correction
+
+The plan and this spec both refer to `UtilitiesCS.Threading.UiThread.Dispatcher`. The type is declared in `UtilitiesCS\Threading\UiThread.cs` but its namespace is `UtilitiesCS`, not `UtilitiesCS.Threading`. `RibbonViewer.EngineCommands.cs` therefore imports `using UtilitiesCS;`. This is a namespace-versus-folder discrepancy in existing source; the explicit-marshalling design AC18 requires is unchanged.
+
+### Deviation 4 — three null-forgiving annotations added for the nullable gate
+
+The P6-T5 command (`msbuild /t:Build /p:Nullable=enable`) returns exit 0, but MSBuild's up-to-date check skips `CoreCompile` when only `/p:` values change, so that result alone does not prove new code is nullable-clean. A forced `/t:Rebuild` verification surfaced three diagnostics in authored code, each resolved without behaviour change:
+
+- `EngineGatedCommandRunner.BuildNotReadyMessage` now looks up the already-non-null `renderedControlId` rather than the raw `controlId` (identical outcome: `"(null)"` is not a catalog key, so it still resolves to `"(unmapped)"`).
+- `RibbonController.EngineCommands.cs` uses `() => Globals?.Engines!`, recording that a null result is a supported value the gate treats as "not ready".
+- `RibbonViewer.EngineCommands.cs` uses `control?.Id!`, recording that a null id is a supported input yielding `false`.
+
+All six new production files are now nullable-clean under a forced rebuild. The residual 220 `CS86xx` errors in `TaskMaster.csproj` are **pre-existing debt in untouched files** (including 18 in the AC15-protected `AppItemEngines.cs` and 40 in the AC15-protected `ApplicationGlobals.cs`) and are recorded, not remediated.
+
+### No other deviation occurred
+
+Apart from the four items above, the change was delivered exactly as designed in this spec and planned in `plan.2026-08-08T11-59.md`. Design option (c) was implemented without re-litigation; no `IsInitialized`/`InitTask` flag was introduced; no member was added to `IAppItemEngines`; no new `catch (Exception)` was introduced anywhere; no new `[ComVisible(true)]` type was added; and the only new `Microsoft.Office.*`-typed member is `public bool EngineCommand_GetEnabled(Office.IRibbonControl control)`.
+
+### Outstanding
+
+**AC19, AC20, and AC21 remain unchecked by design.** They are MANUAL-ONLY and require a live Outlook profile. The maintainer checklist is at `evidence/manual-verification/ac19-ac21-checklist.2026-08-08T15-00.md`, carrying `Status: PENDING MAINTAINER EXECUTION`. They must not be checked off on the strength of unit tests.
+
+Two pre-existing defects observed during execution but deliberately not fixed (both outside the scope lock) are recorded for routing in `evidence/issue-updates/out-of-scope-promotions.2026-08-08T15-05.md`: the `CS2002` duplicate `<Compile Include>` in `UtilitiesCS.Test.csproj`, and the repository-wide nullable debt in `TaskMaster.csproj`.
+
+### Remediation Cycle 1 — 2026-08-08T14-26
+
+Executed against `remediation-plan.2026-08-08T14-26.md` from `remediation-inputs.2026-08-08T14-26.md`, which entered the cycle with **zero blocking findings** and exactly two in-scope Medium findings. This cycle changed **no acceptance criterion's state**; every automated criterion was already checked off by the implementation cycle, and F1 and F2 are quality defects in delivered work rather than unmet criteria.
+
+**F1 — the AC5 ribbon-XML assertion was made non-vacuous. Remediated and proven.** `RibbonExplorerXml_EveryEngineBackedControlDeclaresGetEnabledCallback` in `TaskMaster.Test\Ribbon\RibbonExplorerXmlTests.cs` previously read `...Attribute("getEnabled")?.Value.Should().Be(...)`, where the null-conditional operator short-circuited the whole chain — including `.Should()` — whenever the attribute was absent, which is precisely the regression the test names. The attribute is now bound to a local and asserted `NotBeNull` before `Value` is dereferenced, so all three required failure conditions (attribute missing, attribute present with the wrong value, attribute present but empty) reach a real assertion. Non-vacuity was **demonstrated, not asserted**, by a recorded mutate-build-fail-restore cycle: one `getEnabled` attribute was temporarily deleted from the embedded resource, the assembly was rebuilt and the mutated byte content confirmed at seven attributes before any test ran, the test was recorded **Failed** with the verbatim message `Expected getEnabled not to be <null> because control 'TrainSpam' is engine-backed and must declare a getEnabled callback`, and the mutation was then restored and the test recorded **Passed**. Evidence: `evidence/regression-testing/f1-assertion-shape.2026-08-08T14-52.md`, `evidence/regression-testing/f1-mutated-assembly.2026-08-08T14-52.md`, `evidence/regression-testing/f1-fail-proof.2026-08-08T14-52.md`, `evidence/regression-testing/f1-mutation-restored.2026-08-08T14-52.md`, `evidence/regression-testing/f1-pass-after-restore.2026-08-08T14-52.md`. The permanent tree retains no part of the mutation.
+
+**F2 — `RibbonExplorer.xml` line reduction is NOT remediable as specified. Escalated, not fixed.** F2 asked that the three `TriageSet*` `<button>` elements be restored to single-line form while retaining their `getEnabled` attribute, bringing the file to 527 lines or fewer. That edit was made, passed every Phase 2 gate at 524 lines, and was then **reverted** when the repo-wide `csharpier check .` gate rejected it. Measured cause: CSharpier **1.3.0 formats XML**, `.csharpierignore` excludes `*.csproj`/`*.props`/`*.targets` but not `*.xml`, and the default print width is 100 columns. The merge-base single-line form is 78 characters and fits; adding the functionally required `getEnabled="EngineCommand_GetEnabled"` makes it **116 characters**, so the formatter mandates the multi-line form. The 12 lines the review characterised as "incidental churn with no functional purpose" are in fact formatter-mandated, and the 527-line target is unreachable while the mandatory format gate must pass. `RibbonExplorer.xml` therefore **remains at 539 lines and takes a zero-line diff from this cycle**, superseding nothing; the AC25 pre-existing 519-line exception is unchanged in kind. The only viable route to a smaller file is splitting the resource, which AC25 already declines and which belongs to its own issue. Full measured analysis and the rejected alternatives (all of which would have required weakening a gate or widening scope): `evidence/qa-gates/f2-formatter-conflict.2026-08-08T14-52.md`.
+
+**Toolchain.** The four C# gates passed in a single uninterrupted pass on the second Phase 3 attempt (the first was aborted at the format-verification step by the F2 conflict above, and the restart is disclosed rather than omitted): CSharpier format and repo-wide check exit 0 over 1498 files, analyzer build exit 0 with six warnings all matching the pre-existing baseline, nullable build exit 0, and 6338 of 6338 tests passed with zero failed and zero skipped. First-party coverage moved up on an identical denominator — line 85.8462% to **85.8561%**, branch 79.2559% to **79.2702%** — with the `TaskMaster` package LINE counter byte-identical at `missed=1464 covered=3515` across all three measurement points, confirming no production line changed coverage state. Evidence: `evidence/qa-gates/toolchain-clean-pass.2026-08-08T14-52.md` and `evidence/qa-gates/coverage-comparison.2026-08-08T14-52.md`.
+
+**Protected paths.** `TaskMaster\AppGlobals\AppItemEngines.cs`, `UtilitiesCS\Interfaces\IGlobals\IAppItemEngines.cs`, and `TaskMaster\AppGlobals\ApplicationGlobals.cs` each retain a zero-line diff against the merge-base, verified against the working tree before the commit and against the committed tree after it. AC19, AC20, and AC21 remain unchecked and MANUAL-ONLY.
+
diff --git a/docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md b/docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md
new file mode 100644
index 000000000..7440bac30
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-nullable-gate-cannot-fail-incremental-build.md
@@ -0,0 +1,89 @@
+# nullable-gate-cannot-fail-incremental-build (Issue #512)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/nullable-gate-cannot-fail-incremental-build/ (Issue #512)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #512
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/512
+- Last Updated: 2026-08-08
+## Summary
+
+The repository-mandated type-check gate `msbuild TaskMaster.sln /t:Build /p:Nullable=enable /p:TreatWarningsAsErrors=true` cannot fail in practice. MSBuild's incremental up-to-date check does not invalidate on a command-line `/p:` change alone, so when the outputs are already current from a prior `/t:Build`, `CoreCompile` is skipped entirely and the gate returns exit 0 without ever re-running nullable analysis. The gate has been reporting success while never executing.
+
+## Environment
+
+- OS/version: Windows 11
+- Runtime: .NET Framework 4.8.1
+- Command/flags used: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`
+- Data source or fixture: none
+
+## Steps to Reproduce
+
+1. Run the analyzer build: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:EnableNETAnalyzers=true /p:EnforceCodeStyleInBuild=true`. It succeeds.
+2. Immediately run the mandated type-check gate: `msbuild TaskMaster.sln /t:Build /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`. It returns exit 0.
+3. Now force recompilation of the same code with the same properties: `msbuild TaskMaster\TaskMaster.csproj /t:Rebuild /p:Configuration=Debug /p:Platform="Any CPU" /p:Nullable=enable /p:TreatWarningsAsErrors=true`.
+4. Observe it returns exit 1 with a large number of `CS86xx` nullable errors.
+
+## Expected Behavior
+
+The type-check gate actually performs nullable flow analysis on every invocation and fails when nullable violations exist, so that "the nullable gate passed" is a meaningful statement.
+
+## Actual Behavior
+
+Step 2 returns exit 0 because MSBuild considers the outputs up to date and skips `CoreCompile`. Step 3, which forces recompilation of identical source under identical properties, returns exit 1 with **195 errors, 64 of them `CS86xx`** in `TaskMaster.csproj`. A separate measurement during the same session counted 220 `CS86xx` errors concentrated in `AppOlObjects.cs`, `AppAutoFileObjects.cs`, `AppToDoObjects.cs`, `AppOlObjects.FolderTreeService.cs`, `AppStagingFilenames.cs`, `ApplicationGlobals.cs`, and `AppItemEngines.cs`.
+
+The same source, the same properties, and two different verdicts depending only on whether the output timestamps happened to be current.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet:
+
+```text
+# /t:Build with /p:Nullable=enable /p:TreatWarningsAsErrors=true
+EXIT=0
+
+# /t:Rebuild, same properties, same source
+EXIT=1
+195 errors (64 CS86xx)
+```
+
+Precedent: `.github/workflows/ci.yml` already carries a comment documenting exactly this MSBuild behavior and uses `/t:Rebuild` for its own `TreatWarningsAsErrors` step for that reason. The repository's own CI has the workaround; the policy command documented in `CLAUDE.md` and `.claude/rules/csharp.md` does not.
+
+## Impact / Severity
+
+- [ ] Blocker
+- [x] High
+- [ ] Medium
+- [ ] Low
+
+This is a quality gate that reports success without running. Every agent and developer who has run the documented toolchain has recorded a passing nullable check that did not execute, which means the recorded evidence across prior features overstates what was verified. It also masks a substantial pre-existing nullable debt in `TaskMaster.csproj`.
+
+Severity is High rather than Blocker because the debt it masks is pre-existing rather than newly introduced, and CI's `/t:Rebuild` step does exercise `TreatWarningsAsErrors` (though CI does not pass `/p:Nullable=enable`, so CI does not surface the `CS86xx` set either).
+
+## Suspected Cause / Notes
+
+MSBuild's up-to-date check compares source and output timestamps; it does not hash the effective property set. A `/p:` value that changes compiler behavior therefore does not invalidate a current output.
+
+Two things are entangled here and should be separated when fixing:
+
+1. **The gate defect** — the documented command cannot fail. Fix by changing the documented type-check command to `/t:Rebuild` (matching the existing `ci.yml` precedent), in `CLAUDE.md` § C#1/CUT3, `.claude/rules/csharp.md` § Toolchain, and the `csharp-qa-gate` skill.
+2. **The debt it reveals** — roughly 195-220 errors, ~64 of them `CS86xx`, in `TaskMaster.csproj`. Turning the gate on without addressing the debt would block every subsequent C# change. The debt should be quantified and burned down on its own track, or the gate scoped to changed files first.
+
+Fixing (1) without a plan for (2) will halt C# delivery, so they must be sequenced deliberately.
+
+Found during feature review of issue #503 (ribbon engine readiness guard). Notably, **zero** of the errors are in that change's six new production files, so #503 is not implicated.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: not directly unit-testable; validate by asserting that a deliberately-introduced nullable violation causes the documented command to fail.
+- [x] Integration scenario to retest: add a temporary `CS8600`-triggering line, run the documented gate, confirm exit 1, then remove it.
+- [x] Manual verification notes: measure the exact debt per project before promoting the gate, and decide between full burn-down and changed-files scoping.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md b/docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md
new file mode 100644
index 000000000..f5130a4da
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-ribbon-async-getpressed-signature.md
@@ -0,0 +1,83 @@
+# ribbon-async-getpressed-signature (Issue #505)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/ribbon-async-getpressed-signature/ (Issue #505)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #505
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/505
+- Last Updated: 2026-08-08
+## Summary
+
+`RibbonViewer.SpamBayesEnabled_GetPressed` and `RibbonViewer.TriageEnabled_GetPressed` are declared `async Task<bool>`, but the Office ribbon `getPressed` callback contract requires a synchronous `bool GetPressed(Office.IRibbonControl control)`. Office cannot bind a callback whose return type is `Task<bool>`, so the "SpamBayes Enabled" and "Triage Enabled" toggle buttons never reflect the real engine activation state.
+
+## Environment
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8.1, TaskMaster VSTO add-in
+- Command/flags used: Outlook Explorer ribbon, Spam Manager and Triage configuration menus
+- Data source or fixture: `TaskMaster/Ribbon/RibbonExplorer.xml` embedded resource
+
+## Steps to Reproduce
+
+1. Open Outlook with the TaskMaster add-in loaded and let initialization complete.
+2. Open the Spam Manager save-options menu and observe the "SpamBayes Enabled" toggle button.
+3. Toggle the engine off via `SpamBayesEnabled_Click`, then reopen the menu.
+4. Repeat for the "Triage Enabled" toggle button.
+
+## Expected Behavior
+
+The toggle button's pressed state reflects `Globals.Engines.EngineActiveAsync(<engineName>)` — pressed when the classifier is activated, unpressed when it is not — and updates when the engine is toggled.
+
+## Actual Behavior
+
+Office resolves `getPressed` by name and requires the exact signature `bool GetPressed(IRibbonControl control)`. Both methods return `Task<bool>`:
+
+```csharp
+public async Task<bool> SpamBayesEnabled_GetPressed(Office.IRibbonControl control) =>
+    await Controller.Engines.EngineActiveAsync(SpamBayes.GroupName);
+
+public async Task<bool> TriageEnabled_GetPressed(Office.IRibbonControl control) =>
+    await Controller.Engines.EngineActiveAsync("Triage");
+```
+
+(`TaskMaster/Ribbon/RibbonViewer.cs`, Spam Config and Triage Config regions.)
+
+The callback does not bind, so the pressed state is not driven by the engine configuration.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet: see the source excerpt above. Office does not surface a user-visible error for a signature-incompatible callback; the failure is silent unless Office is run with the "Show add-in user interface errors" developer option enabled.
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [x] Medium
+- [ ] Low
+
+Two configuration toggles display a state that is not tied to the underlying setting. The commands themselves still work, so this is a state-display defect rather than a functional break, but it misrepresents engine configuration to the user.
+
+## Suspected Cause / Notes
+
+The underlying accessor `IAppItemEngines.EngineActiveAsync(string)` is asynchronous because it awaits `Globals.AF.Manager.Configuration`. The ribbon callback contract is synchronous and cannot await. Blocking on the task inside the callback is not an acceptable fix: the callback runs on the Outlook UI/STA thread and a synchronous wait on a continuation that needs that thread would deadlock.
+
+The likely correct shape is a cached, synchronously-readable activation snapshot that the async configuration path populates, with `IRibbonUI.InvalidateControl(<controlId>)` called when it changes. That is the same refresh mechanism being introduced for issue #503, so this work should be sequenced after #503 lands and should reuse its readiness/refresh infrastructure rather than inventing a parallel one.
+
+Found while researching issue #503 (ribbon engine readiness guard); out of scope for that fix.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: a reflection-based signature test asserting that every `getPressed`/`getEnabled` name declared in `RibbonExplorer.xml` resolves to a method returning `bool` and taking a single `IRibbonControl` parameter; unit tests for the synchronous activation-snapshot accessor.
+- [x] Integration scenario to retest: toggle each engine in live Outlook and confirm the toggle button pressed state tracks the setting across menu reopen and add-in reload.
+- [x] Manual verification notes: confirm no UI-thread deadlock under a cold configuration load.
+
+Sequencing note: depends on issue #503 for the ribbon invalidation infrastructure.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md b/docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md
new file mode 100644
index 000000000..e4e3ab032
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-ribbon-controller-engines-null-unsafe.md
@@ -0,0 +1,85 @@
+# ribbon-controller-engines-null-unsafe (Issue #507)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/ribbon-controller-engines-null-unsafe/ (Issue #507)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #507
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/507
+- Last Updated: 2026-08-08
+## Summary
+
+`RibbonController.Engines` is declared `internal IAppItemEngines Engines => Globals.Engines;` with no null guard on `Globals`, unlike its sibling properties `SB` and `Triage` in the same file which both use `Globals?.`. Any ribbon callback that reaches `Engines` before `SetGlobals` has run throws `NullReferenceException`.
+
+## Environment
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8.1, TaskMaster VSTO add-in
+- Command/flags used: Outlook Explorer ribbon, Spam Manager and Triage configuration menus
+- Data source or fixture: Live Outlook profile during add-in startup
+
+## Steps to Reproduce
+
+1. Reload the TaskMaster add-in so the ribbon is constructed before the controller's `Globals` is assigned.
+2. Invoke any callback that routes through `RibbonController.Engines` — `TestSpam_Click`, `SpamBayesEnabled_Click`, `SpamBayesEnabled_GetPressed`, `SpamSaveNetwork_Click`, `SpamSaveLocal_Click`, `GetSaveLocation_Click`, `TriageEnabled_Click`, `TriageEnabled_GetPressed`, `TriageSaveNetwork_Click`, `TriageSaveLocal_Click`, or `TriageGetSaveLocation_Click`.
+3. Observe the `NullReferenceException`.
+
+## Expected Behavior
+
+`Engines` behaves like its siblings and returns `null` rather than throwing when `Globals` has not yet been assigned, so callers can guard. The sibling precedent is already in the same file:
+
+```csharp
+return Globals?.Engines?.InboxEngines?.TryGetValue("Spam", out var engine) ?? false
+    ? engine as SpamBayes
+    : null;
+```
+
+## Actual Behavior
+
+```csharp
+internal IAppItemEngines Engines => Globals.Engines;
+```
+
+(`TaskMaster/Ribbon/RibbonController.Intelligence.cs`, Spam Manager region.)
+
+`Globals` is unguarded, so the property throws instead of returning `null`.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet:
+
+```text
+System.NullReferenceException: Object reference not set to an instance of an object.
+   at TaskMaster.RibbonController.get_Engines()
+```
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [ ] Medium
+- [x] Low
+
+The reachable window is narrower than the one in issue #503 (it requires the callback to run before `SetGlobals` rather than merely before `InitAsync`), and the affected callbacks are in configuration submenus rather than primary commands. It is nevertheless a real inconsistency with the sibling properties and an avoidable throw.
+
+## Suspected Cause / Notes
+
+Inconsistent null-guard application within a single file. `SB` (Spam Manager region) and `Triage` (Triage region) both null-propagate through `Globals?.`; `Engines`, declared between them, does not.
+
+This is related to but distinct from issue #503. #503 addresses the window where `Globals` is assigned but `InboxEngines` is not yet populated. This defect addresses the earlier window where `Globals` itself is null. The readiness gate introduced by #503 accesses engines through a `Func<IAppItemEngines>` accessor built as `() => Globals?.Engines`, which is null-safe by construction, so #503 does not depend on this fix and does not remediate it.
+
+Found while researching issue #503; out of scope for that fix.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: assert `Engines` returns `null` rather than throwing when `Globals` is unassigned, using the existing `FormatterServices.GetUninitializedObject` controller-construction pattern in `TaskMaster.Test/Ribbon/RibbonControllerTests.cs`. Note that `RibbonController` is `[ExcludeFromCodeCoverage]`, so a genuine fix should consider whether the accessor belongs in a host-neutral testable type rather than only adding `?.`.
+- [x] Integration scenario to retest: exercise the Spam and Triage configuration submenus immediately after add-in reload.
+- [x] Manual verification notes: confirm no behavior change once `Globals` is assigned.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md b/docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md
new file mode 100644
index 000000000..cc93e7801
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-ribbon-dead-callback-names.md
@@ -0,0 +1,81 @@
+# ribbon-dead-callback-names (Issue #504)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/ribbon-dead-callback-names/ (Issue #504)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #504
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/504
+- Last Updated: 2026-08-08
+## Summary
+
+Five `onAction` callback names declared in `TaskMaster/Ribbon/RibbonExplorer.xml` have no matching method on `RibbonViewer`. Office binds ribbon callbacks by name at runtime and silently ignores a name it cannot resolve, so the affected controls render normally but do nothing when clicked. Four of the five are a `_Clicked` / `_Click` suffix mismatch on the Quick Filer settings check boxes, which means four user-facing settings toggles are inert.
+
+## Environment
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8.1, TaskMaster VSTO add-in
+- Command/flags used: Outlook Explorer ribbon
+- Data source or fixture: `TaskMaster/Ribbon/RibbonExplorer.xml` embedded resource
+
+## Steps to Reproduce
+
+1. Open Outlook with the TaskMaster add-in loaded.
+2. Open the Quick Filer settings menu on the TaskMaster ribbon tab.
+3. Toggle "Move Entire Conversation", "Save Attachments", "Save Email Copy", or "Save Pictures".
+4. Reopen the menu and observe the toggle state, or inspect the backing setting.
+
+## Expected Behavior
+
+Each check box invokes its handler and flips the corresponding `Globals.InternalQfSettings` value. `RibbonController` already implements the intended toggles (`ToggleMoveEntireConversation`, `ToggleSaveAttachments`, `ToggleSaveEmailCopy`, `ToggleSavePictures` in `TaskMaster/Ribbon/RibbonController.Intelligence.cs`), and `RibbonViewer` already exposes correctly-named wrappers.
+
+## Actual Behavior
+
+The XML declares `onAction="MoveEntireConversation_Clicked"` (and the three sibling `_Clicked` names), but `RibbonViewer` defines `MoveEntireConversation_Click` (no `ed`). Office cannot resolve the declared name, so the click is a no-op. The setting never changes. `getPressed` is wired correctly, so the check box also never appears to change state.
+
+Separately, `onAction="BtnMigrateIDs_Click"` is declared but no such method exists anywhere in the assembly.
+
+Verified by enumerating every `onAction`/`getPressed`/`getEnabled`/`getText`/`onChange` value in the XML (89 unique names) and checking each against `TaskMaster/Ribbon/RibbonViewer.cs`:
+
+```text
+MISSING: BtnMigrateIDs_Click
+MISSING: MoveEntireConversation_Clicked
+MISSING: SaveAttachments_Clicked
+MISSING: SaveEmailCopy_Clicked
+MISSING: SavePictures_Clicked
+```
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet: see the verification output above. Office does not surface a user-visible error for an unresolved callback name; the failure is silent unless Office is run with the "Show add-in user interface errors" developer option enabled.
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [x] Medium
+- [ ] Low
+
+Four user-facing Quick Filer settings cannot be changed from the ribbon. The failure is silent, so a user has no signal that the toggle did not take effect. The fifth name is a control with no implementation at all.
+
+## Suspected Cause / Notes
+
+Naming drift between the ribbon XML and the callback class. `RibbonViewer` consistently uses the `_Click` suffix; these four XML entries use `_Clicked`. `BtnMigrateIDs_Click` appears to be a control whose implementation was never added or was removed without removing the XML entry.
+
+The existing regression suite `TaskMaster.Test/Ribbon/RibbonExplorerXmlTests.cs` validates the CustomUI schema structure of the ribbon document but does not validate that every declared callback name resolves to a method with a signature Office can bind. That missing check is why the drift was not caught.
+
+Found while researching issue #503 (ribbon engine readiness guard); out of scope for that fix.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: extend `RibbonExplorerXmlTests` with a reflection-based test that asserts every `onAction`/`getPressed`/`getEnabled`/`getText`/`onChange` name declared in the XML resolves to a public method on `RibbonViewer`. This turns the whole class of drift into a build-time failure.
+- [x] Integration scenario to retest: toggle each Quick Filer settings check box in live Outlook and confirm the backing setting changes and the check state persists.
+- [x] Manual verification notes: decide whether `BtnMigrateIDs` should be implemented or removed from the XML.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md b/docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md
new file mode 100644
index 000000000..61fbac1c5
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-ribbon-toggle-engine-fire-and-forget.md
@@ -0,0 +1,83 @@
+# ribbon-toggle-engine-fire-and-forget (Issue #506)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/ribbon-toggle-engine-fire-and-forget/ (Issue #506)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #506
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/506
+- Last Updated: 2026-08-08
+## Summary
+
+`RibbonViewer.SpamBayesEnabled_Click` and `RibbonViewer.TriageEnabled_Click` are `void` methods whose body is an unawaited call to `Controller.Engines.ToggleEngineAsync(...)`. The returned `Task` is discarded, so the toggle completes asynchronously with no ordering guarantee and any exception it raises is swallowed into an unobserved task.
+
+## Environment
+
+- OS/version: Windows 11, Outlook desktop (VSTO add-in host)
+- Runtime: .NET Framework 4.8.1, TaskMaster VSTO add-in
+- Command/flags used: Outlook Explorer ribbon, Spam Manager and Triage configuration menus
+- Data source or fixture: Live Outlook profile
+
+## Steps to Reproduce
+
+1. Open Outlook with the TaskMaster add-in loaded.
+2. Click the "SpamBayes Enabled" toggle button (or "Triage Enabled").
+3. Observe that the caller returns before `ToggleEngineAsync` has awaited `Globals.AF.Manager.Configuration` and flipped `ClassifierActivated`.
+4. Induce a failure inside the configuration load and observe that no error is surfaced.
+
+## Expected Behavior
+
+The toggle either completes before the handler returns, or the handler is `async void` with an explicit `await` and a boundary `try/catch` that reports the failure through the project logging pattern. Either way an exception is observed and logged rather than discarded.
+
+## Actual Behavior
+
+```csharp
+public void SpamBayesEnabled_Click(Office.IRibbonControl control, bool pressed) =>
+    Controller.Engines.ToggleEngineAsync(SpamBayes.GroupName);
+
+public void TriageEnabled_Click(Office.IRibbonControl control, bool pressed) =>
+    Controller.Engines.ToggleEngineAsync("Triage");
+```
+
+(`TaskMaster/Ribbon/RibbonViewer.cs`, Spam Config and Triage Config regions.)
+
+`ToggleEngineAsync` awaits `Globals.AF.Manager.Configuration` before mutating `loader.Config.ClassifierActivated`, so the state change is genuinely deferred. The discarded `Task` means a faulted toggle is silently lost; the user sees no error and the setting simply does not change.
+
+The sibling handlers in the same regions (`SpamSaveNetwork_Click`, `SpamSaveLocal_Click`, `TriageSaveNetwork_Click`, `TriageSaveLocal_Click`) are correctly written as `async void` with `await`, which makes these two an inconsistency rather than a deliberate pattern.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet: see the source excerpt above. No log entry is produced on failure, which is the defect.
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [ ] Medium
+- [x] Low
+
+The happy path usually works because the configuration task is typically already complete by the time a user reaches the configuration menu. The defect is the swallowed failure and the absent ordering guarantee, not a routinely-observed break.
+
+## Suspected Cause / Notes
+
+Two handlers were written as expression-bodied `void` members while their siblings were written as `async void` with `await`. The compiler does not warn here because the discarded value is a `Task` returned from an expression-bodied member.
+
+Note that `.claude/rules/general-code-change.md` requires failing fast and explicitly and prohibits silently ignoring errors, which this violates.
+
+Found while researching issue #503 (ribbon engine readiness guard); out of scope for that fix.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: extract the toggle invocation behind a testable seam and assert the returned task is awaited and that a faulted task is reported through the logging sink rather than discarded.
+- [x] Integration scenario to retest: toggle each engine in live Outlook and confirm the setting changes and a failure is surfaced.
+- [x] Manual verification notes: confirm the handler does not block the Outlook UI thread.
+
+Consider whether an analyzer rule (for example the existing AsyncFixer package listed in `.claude/rules/csharp.md`) can be raised to catch discarded tasks across the codebase rather than fixing only these two sites.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch
diff --git a/docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md b/docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md
new file mode 100644
index 000000000..af57c5a36
--- /dev/null
+++ b/docs/features/potential/promoted/2026-08-08-wpf-dispatcher-yield-test-order-dependent.md
@@ -0,0 +1,98 @@
+# wpf-dispatcher-yield-test-order-dependent (Issue #508)
+
+- Date captured: 2026-08-08
+- Author: Dan Moisan
+- Status: Promoted -> docs/features/active/wpf-dispatcher-yield-test-order-dependent/ (Issue #508)
+
+> Automation note: Keep the section headings below unchanged; the promotion tooling maps each of them into the GitHub bug issue template.
+
+- Issue: #508
+- Issue URL: https://github.com/drmoisan/TaskMaster/issues/508
+- Last Updated: 2026-08-08
+## Summary
+
+`UtilitiesCS.Test\OutlookObjects\Folder\WpfDispatcherYieldTests.YieldAsync_WithoutDispatcher_RemainsStrict` fails intermittently on the full-suite run. The test asserts that `WpfDispatcherYield.YieldAsync` throws `InvalidOperationException` when no WPF `Dispatcher` is associated with the current thread, but under class-level parallel execution the pooled worker thread it lands on may already have a `Dispatcher` attached by an earlier test, so no exception is thrown and the assertion fails.
+
+## Environment
+
+- OS/version: Windows 11
+- Runtime: .NET Framework 4.8.1
+- Command/flags used: `pwsh -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -Configuration Debug` (full-suite run, class-level parallelization, 24 workers)
+- Data source or fixture: none
+
+## Steps to Reproduce
+
+1. Build the solution in Debug.
+2. Run the full MSTest suite across all `*.Test.dll` assemblies with parallelization enabled, as CI and the local coverage script both do.
+3. Repeat the run.
+
+Observed across two consecutive baseline runs on `bug/ribbon-engine-readiness-guard-503` at merge-base `003c5715`:
+
+- Run 1: `Total tests: 6293, Passed: 6291, Failed: 2`
+- Run 2: `Failed: 1` — `YieldAsync_WithoutDispatcher_RemainsStrict`
+
+The failure count changed between runs with no intervening code change, which establishes non-determinism rather than a deterministic regression.
+
+## Expected Behavior
+
+The test produces the same result on every run regardless of which other tests executed first or which pooled thread it runs on, per `.claude/rules/general-unit-test.md` Core Principles 1 (Independence) and 4 (Determinism).
+
+## Actual Behavior
+
+```csharp
+[TestMethod]
+public async Task YieldAsync_WithoutDispatcher_RemainsStrict()
+{
+    var dispatcherYield = new WpfDispatcherYield();
+
+    await dispatcherYield
+        .Invoking(item => item.YieldAsync(CancellationToken.None))
+        .Should()
+        .ThrowAsync<InvalidOperationException>();
+}
+```
+
+(`UtilitiesCS.Test/OutlookObjects/Folder/WpfDispatcherYieldTests.cs:28-37`.)
+
+The "without dispatcher" precondition is an ambient property of the executing thread, not something the test arranges. `Dispatcher.CurrentDispatcher` creates and caches a dispatcher for the calling thread on first access, so any earlier test on the same pooled worker that touches a WPF dispatcher leaves one attached, and this test's precondition silently evaporates.
+
+## Logs / Screenshots
+
+- [x] Attached minimal logs or snippet
+- Snippet:
+
+```text
+  Failed YieldAsync_WithoutDispatcher_RemainsStrict [162 ms]
+  Error Message:
+     Failed: 1
+```
+
+## Impact / Severity
+
+- [ ] Blocker
+- [ ] High
+- [x] Medium
+- [ ] Low
+
+The suite is not reliably green at baseline, which undermines every downstream quality gate: an agent or developer cannot distinguish "my change broke a test" from "the suite is flaky". It also produces spurious CI failures and encourages re-running until green, which is the failure mode the determinism rule exists to prevent.
+
+## Suspected Cause / Notes
+
+The test depends on ambient thread state rather than arranging its own precondition. The correct shape is to run the "no dispatcher" assertion on a thread the test itself owns and can guarantee is dispatcher-free, or to seam the dispatcher lookup behind an injectable accessor so the absent-dispatcher case can be arranged explicitly rather than inherited.
+
+Note that `.claude/rules/csharp.md` prohibits "adding sleeps, retries, or timing hacks to mask flaky behavior", so `[Retry]`-style mitigation is not an acceptable fix. `.claude/rules/general-unit-test.md` requires seam-based mocking for external boundaries, which points at the injectable-accessor approach.
+
+The sibling test `YieldAsync_CanceledToken_ThrowsBeforeDispatcherYield` is unaffected because it cancels before the dispatcher is consulted.
+
+Found while capturing the merge-base baseline for issue #503 (ribbon engine readiness guard); out of scope for that fix. Recorded there as a known pre-existing baseline condition so it is not misattributed to #503.
+
+## Proposed Fix / Validation Ideas
+
+- [x] Unit coverage areas: arrange the dispatcher-free precondition explicitly (dedicated owned thread, or an injected dispatcher accessor returning null) so the assertion is deterministic.
+- [x] Integration scenario to retest: run the full suite repeatedly and confirm a stable pass count across runs.
+- [x] Manual verification notes: confirm no `[DoNotParallelize]` blanket suppression is used as the fix, since that hides the dependency rather than removing it.
+
+## Next Step
+
+- [ ] Promote to GitHub issue (bug-report template)
+- [ ] Move to active fix folder / branch