NTFSSecurity/Tests/Coverage/Quality-Gate-Paths-2026-10-09-Explanations.md

# Explanations of the unvisited code, by rule

Generated from the classification of the unvisited methods in the aggregated
AltCover report of source `5a5d58b`.
[Quality-Gate-Paths-2026-10-09.md](./Quality-Gate-Paths-2026-10-09.md)
describes the method and the result; the rows of every method are in the CSV
file next to it. An explanation closes a path only as far as its evidence
goes: the evidence line of each rule says whether an executed probe, a static
scan of the compiled code, or reading the source supports it.

## By category

| Category | Disposition | Methods | Unvisited sequence points | Unvisited explicit branch points |
| --- | --- | ---: | ---: | ---: |
| unused by cmdlets | Explained | 60 | 173 | 34 |
| parameter/API surface | Explained | 103 | 103 | 0 |
| environment-specific | Explained | 27 | 81 | 18 |
| defensive | Explained | 33 | 77 | 16 |
| unused by cmdlets | Open | 8 | 8 | 2 |
| **Total** | | **231** | **442** | **70** |

## By rule

### ACCESS-GENERIC-CATCH

8 method(s), 32 unvisited sequence point(s), 3 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: ClearAccess, DisableAccessInheritance, EnableAccessInheritance,
GetAccess, GetInheritance, GetOrphanedAccess, GetSecurityDescriptor,
OwnerCmdlets.GetOwner.

Evidence: an executed probe.

Why: The unvisited points are the last catch (Exception) of the per-item loop,
taken when the DACL API fails with anything but access denied after the item
was found. A read or write of the DACL on local NTFS either succeeds or fails
with access denied (covered), and the probes found no other failure for these
cmdlets: an unresolvable SID is accepted, a locked file does not matter
because the security APIs ignore share modes, and a dangling junction is read
as the link itself. One input does trigger that catch, a deny entry without
rights, which .NET refuses with an ArgumentException; Add-NTFSAccess,
Remove-NTFSAccess and Add-NTFSAudit take it and are tested (an Allow entry
without rights is accepted, because the module adds Synchronize to it). A
cmdlet that has no rights parameter, such as the read and inheritance cmdlets,
has no such input. A second trigger exists for the cmdlets that add entries:
an ACL that is full. In both editions the 1,818th entry that was added to a
security descriptor in memory, with -SecurityDescriptor, raised an
OverflowException, "Length of the access control list exceed the allowed
maximum" (probe p37: unresolvable SIDs with ReadData; 1,816 entries were
written and read back without an error, and one more added with -Path
succeeded, so the overflow itself was not run with -Path). By reading the
source, the -Path loop takes that exception in the same handler as the
zero-mask case, whereas the -SecurityDescriptor sets have no handler around
the add, so there the exception ends the cmdlet. It was not turned into a test
of its own. A volume without ACL support or a corrupt descriptor cannot be
created safely on the shared host.

Residual risk: Low: one WriteError(exception, id, category, path) and
continue, the shape that the access-denied and ReadFileError siblings of the
same loops assert and that the zero-mask tests assert for the cmdlets that add
and remove entries. The catches of the cmdlets that only read or change
inheritance have no known trigger. A catch that wraps the write of the result
is entered also when a later command raises something while it takes the
object; every catch-all whose try block writes directly passes that exception
on (a scan of the source finds no exception; it cannot see a write inside a
helper such as the owner restore of InvokeAsOwner, an accepted limitation),
and the PipelineControl tests run that part for every cmdlet.

Related tests: Access.Tests and Audit.Tests: a deny or audit entry without
rights for Add-NTFSAccess, Remove-NTFSAccess and Add-NTFSAudit (AddAceError
and RemoveAceError, ArgumentException, WriteError, target, continuation,
nothing written). PathErrors: ReadFileError, ReadSecurityError, denied write
and ownership retry, each with continuation. PipelineControl.Tests: a break, a
continue, Select-Object -First, a throw, and an error with -ErrorAction Stop
after the first object.

### ALLOCATED-MEMORY-FINALIZER

2 method(s), 3 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: AllocatedMemory.

Evidence: reading the source.

Why: AllocatedMemory is internal and used only in a using block of
GetTokenPrivileges, which disposes it and suppresses the finalizer. The
finalizer and the branch for a pointer that was released already run only for
an instance that nobody disposed.

Residual risk: None found.

Related tests: Privileges.Tests: the token handle tests list the privileges
through it.

### AUDIT-OWNER-RETRY

10 method(s), 47 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: AddAudit, AddAudit/<>c__DisplayClass35_0, ClearAudit,
ClearAudit/<>c__DisplayClass11_0, DisableAuditInheritance,
DisableAuditInheritance/<>c__DisplayClass15_0, EnableAuditInheritance,
EnableAuditInheritance/<>c__DisplayClass15_0, RemoveAudit,
RemoveAudit/<>c__DisplayClass39_0.

Evidence: an executed probe.

Why: The unvisited points are the catch (UnauthorizedAccessException) of an
audit write, its InvokeAsOwner retry and the closure of that retry. Local NTFS
never raises that exception for an audit change: as a basic user all seven
audit cmdlets get an IOException, error 1314 (A required privilege is not
held), in both editions (probe); with the Security privilege nothing in a DACL
can deny the privilege-only right, and a loopback administrative share ended
in no exception for all five either (probe, elevated, EnablePrivileges on and
off). The retry is the InvokeAsOwner code that the access cmdlets share, so
its success, failure and RestoreOwnerError paths run there; only the audit
closure bodies, which repeat the first attempt, are unexecuted.

Residual risk: Low to medium: an audit write that a file server answers with
access denied runs lines that no instrumented test reaches. The live lab suite
runs the audit cmdlets over SMB outside the instrumented run.

Related tests: PathErrors (denied write and ownership retry for the access
cmdlets), FileHash and SecurityDescriptor tests (ownership retry), Audit.Tests
(privilege missing or disabled).

### AUDIT-READ-DENIED

2 method(s), 6 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: AuditCmdlets.GetOrphanedAudit, GetAudit.

Evidence: an executed probe.

Why: The unvisited points are the catch (UnauthorizedAccessException) that
writes a PermissionDenied ReadSecurityError for an audit read. Without the
Security privilege Windows answers error 1314, which AlphaFS raises as an
IOException (probe as a basic user, both editions) and the generic catch of
the same loop reports as an OpenError; with the privilege, nothing denies the
read locally. An access-denied answer needs a remote file server.

Residual risk: Low: the same WriteError statement with another category.

Related tests: Audit.Tests: error without the Security privilege, descriptor
read without audit entries.

### CHILDITEM2-NON-FOLDER

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: GetChildItem2.

Evidence: reading the source.

Why: The else of the test for a DirectoryInfo at the start of WriteFileSystem:
both callers pass one, ProcessRecord after it returned for a file, and the
recursion with the folders that EnumerateDirectories returned.

Residual risk: None found.

Related tests: ItemCmdlets.Tests: files, folders, recursion, filters, depth.

### CMDLET-GETTER

103 method(s), 103 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: parameter/API surface. Disposition: Explained.

Classes: AddAccess, AddAudit, ClearAccess, ClearAudit, CopyItem2,
DisableAccessInheritance, DisableAuditInheritance, DisablePrivileges,
EnableAccessInheritance, EnableAuditInheritance, EnablePrivileges,
GetChildItem2, GetDiskSpace, GetEffectiveAccess, GetFileHash2, GetInheritance,
GetItem2, GetSecurityDescriptor, GetSimpleAccess, MoveItem2, NewHardLink,
NewSymbolicLink, RemoveAccess, RemoveAudit, RemoveItem2, SetInheritance,
SetOwner, SetSecurityDescriptor.

Evidence: reading the source.

Why: A one-line getter of a cmdlet parameter. PowerShell binds a parameter
through its setter and the cmdlet code reads the private field, so no caller
invokes the getter. It has no logic, so a test that reads it back repeats the
field assignment and proves no behavior.

Residual risk: None found.

Related tests: Every parameter-set test binds the setters; Help.Tests and
OutputTypes.Tests read the parameter metadata.

### CODEMEMBERS-NULL-BASE

1 method(s), 1 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: FileSystemCodeMembers.

Evidence: an executed probe.

Why: The second null check tests the base object of the PSObject that the
first check let through. A PSObject cannot wrap null: new PSObject($null) and
PSObject.AsPSObject($null) throw PSArgumentNullException in both editions
(probe), and PowerShell hands a $null argument over as null, which the first
check covers.

Residual risk: None found.

Related tests: ItemCmdlets.Tests: the Mode of files, of a folder, and of no
object.

### DISKSPACE-EMPTY-VOLUME

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: GetDiskSpace.

Evidence: reading the source.

Why: The unvisited branch skips a volume that reports zero bytes, such as a
card reader or an optical drive without media. The host has none, and a test
cannot attach one without changing the shared machine.

Residual risk: Low: the volume is skipped silently.

Related tests: ItemCmdlets.Tests: volumes with a size, drive letter without a
volume.

### EFFECTIVE-ACCESS-CATCH

2 method(s), 10 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: GetEffectiveAccess, GetEffectiveAccess/<>c__DisplayClass20_0.

Evidence: reading the source.

Why: EffectiveAccess.GetEffectiveAccess hides every failure of its Authz calls
in a result with OperationFailed, which the cmdlet turns into
GetEffectiveAccessError. The catch (Exception) blocks and the InvokeAsOwner
retry therefore see an exception only from what runs outside those calls: the
read of the descriptor of the item (EffectiveAccess.cs, the FileSystemInfo
overload) or the conversion of the account. The only local failure of the
descriptor read is access denied, which the UnauthorizedAccessException branch
handles and the tests cover; no other local trigger was found, and the
unresolved identity, which the conversion accepts, ends in OperationFailed.

Residual risk: Low: a failure of the descriptor read other than access denied,
such as an I/O error of the volume, would run the unvisited catch, which
writes one ReadEffectivePermissionError and continues like its tested
siblings.

Related tests: Access.Tests: unresolved identity for a path and a descriptor,
remote fallback, privilege warnings.

### ENABLEPRIVILEGES-INIT

1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: EnablePrivileges.

Evidence: reading the source.

Why: The branches that test whether the caller is a script named
NTFSSecurity.Init.ps1 are run by Privileges.Tests, which writes a script of
that name and of another name and runs each in a child process. The tests
check the state of the Backup privilege and the verbose message that only the
cmdlet writes, because with the setting $true the module enables the
privileges itself before the cmdlet runs: from the Init script the cmdlet
enables them for EnablePrivileges $true and does nothing for $false, from
another script it enables them for both. The script that the module ships
under that name does not call Enable-Privileges (it adds the types). What
stays unvisited is the catch that rethrows a ParseException for a malformed
EnablePrivileges value: the base BeginProcessing casts the same value first
and fails earlier, and the cmdlet takes no pipeline input, so only a consumer
of the debug or verbose stream could change the setting between the two calls.

Residual risk: Low: the catch rethrows with a message that names the setting;
it was not run.

Related tests: Privileges.Tests: Enable-Privileges in the script
NTFSSecurity.Init.ps1 (three cases), Enable-Privileges and Disable-Privileges.

### FILESECURITY-CONVERSION

2 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Open.

Classes: FileSystemSecurity2.

Evidence: an executed probe.

Why: The implicit conversions from FileSecurity and DirectorySecurity
construct FileSystemSecurity2 from FileInfo("") and DirectoryInfo(""), so they
always throw ArgumentException (probe: "Path is a zero-length string"). A test
of the intended behavior would fail, and a test of the actual behavior would
cement a defect in an API that no cmdlet uses.

Residual risk: Library users who convert a .NET descriptor get an exception.
Fix or remove is a maintainer decision.

Related tests: None, on purpose.

### FSSEC2-CONSTRUCTOR-FALLBACK

1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: FileSystemSecurity2.

Evidence: reading the source.

Why: The unvisited points are the last fallback of the constructor with one
argument: the DACL read alone after the DACL read together with the owner and
the group failed. The first fallback, without the SACL when the Security
privilege is missing, runs in the basic configurations. The owner and the
group need the same READ_CONTROL right as the DACL, so the third read succeeds
only where a volume or a server answers them differently.

Residual risk: Low: the descriptor that the fallback returns holds the DACL
only, and the cmdlets that need more report it.

Related tests: SecurityDescriptor.Tests and Audit.Tests: a descriptor read
without the Security privilege.

### FSSEC2-DRIVE-LETTER-CHARS

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: FileSystemSecurity2.

Evidence: reading the source.

Why: The unvisited branch is a first character that is no letter in front of
the colon. AlphaFS normalizes the full name, so a name of two characters that
ends in a colon always begins with a drive letter, in upper or lower case
(both run); a digit or another character cannot form such a name.

Residual risk: None found.

Related tests: DriveRoot.Tests: the system drive and a mapped drive;
ObjectApis.Tests: a lowercase drive letter.

### FSSEC2-HASHCODE-NULL

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: FileSystemSecurity2.

Evidence: reading the source.

Why: The zero is for a descriptor without a wrapped .NET descriptor. Both
constructors set it, because GetSecurity returns a descriptor or throws, and
the conversions from FileSecurity and DirectorySecurity throw before an object
exists. Only a derived class that sets the field to null reaches it.

Residual risk: None found.

Related tests: SecurityDescriptor.Tests: equality, hash code, and use as a
key.

### GENERATED-RESOURCES

6 method(s), 12 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Explained.

Classes: Properties.Resources.

Evidence: reading the source.

Why: The designer-generated resource class of two icons that no code
references.

Residual risk: None found.

Related tests: None needed.

### HARDLINK-DENIED

1 method(s), 3 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: GetHardLink.

Evidence: an executed probe.

Why: The unvisited points are the catch (UnauthorizedAccessException) of the
hard link enumeration. No local input was found that raises it: with deny
entries for ReadAttributes, ReadData and ReadPermissions for OWNER RIGHTS and
for the user, and automatic privileges off, Get-NTFSHardLink still listed the
names (probe p32, elevated, both editions), and Links.Tests asserts that
listing while the data of the file cannot be read (Get-Content fails). Whether
a denial of ReadAttributes or ReadPermissions alone could change that was not
shown: an elevated session read the permissions despite the deny entries, so
the test asserts only the refused data. The IOException of a network share,
(50), is covered.

Residual risk: Low: one WriteError with the PermissionDenied category. If a
Windows version or a file server refuses the listing, the new test fails and
this catch is reached.

Related tests: Links.Tests: the names of a file whose read rights are denied,
error for a file on a network share, for a folder and for a missing path.

### HASH-POLICY-AND-RETRY

2 method(s), 7 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: GetFileHash2, GetFileHash2/<>c__DisplayClass9_0.

Evidence: an executed probe.

Why: Two groups. The second catch around the algorithm check handles an
algorithm that a FIPS policy refuses; the policy of the host cannot be
switched in a test. The closing points after InvokeAsOwner run only when the
hash succeeds after taking ownership: ownership grants READ_CONTROL and
WRITE_DAC but never data read, so the retry can only fail, which two tests
assert. Probes looked for a way around that: with the owner changed to the
user the read still ended in access denied (error 5, plus a RestoreOwnerError
1307 for an owner that the user cannot set back), and an OWNER RIGHTS deny is
no way in either, because Windows drops that entry when the owner changes.

Residual risk: Low: the success path after the retry has no local trigger. A
file server that grants the read to the owner only would run it.

Related tests: FileHash.Tests: unavailable algorithms, unreadable file,
restore of the previous owner, failed restore.

### IDENTITY-NULL-REFERENCE

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: IdentityReference2.

Evidence: reading the source.

Why: The unvisited branch is an IdentityReference that is neither an NTAccount
nor a SecurityIdentifier, which only null is: the .NET class has no other
public subclass. The object then has no SID and every member fails with a
NullReferenceException. No cmdlet passes null, and a test would cement that
failure.

Residual risk: Low: a library caller that passes null gets an unusable object.

Related tests: ObjectApis.Tests: identity constructors and their errors.

### INHERITED-FROM-EMPTY-LIST

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: FileSystemAuditRule2.

Evidence: an executed probe.

Why: The access twin is tested: a NULL DACL, which Windows reads as an ACL
with no entries and .NET reports as one entry for Everyone, runs the branch
where the list of sources is empty (Access.Tests). The unvisited branch that
remains is the second operand of getInheritedFrom && inheritedFrom.Count > 0
in the audit twin. GetInheritedFrom returns one source for each entry of the
SACL that it reads, also for the fallback text of an unknown parent, and an
empty list only for a descriptor without a SACL. The loop that holds the
condition runs over the audit entries of the same SACL, so an empty list means
that the loop has no entry and does not run, as for every item without a SACL
(Audit.Tests: the item has no SACL). The setting that turns the lookup off and
the fallback cover the other outcomes. A probe shows that an integrity label
in the SACL of a folder is not part of the SACL that the module reads, so the
sources of the audit entries stay aligned with the entries (probe, both
editions).

Residual risk: Low: the two lists are aligned by position, which assumes that
the .NET API returns a rule for every entry of the ACL that Windows names a
source for; an entry type that it skips would shift the sources. No such entry
was found on NTFS, and none was tested.

Related tests: Access.Tests: InheritedFrom with the setting on and off, for an
unknown parent and for a NULL DACL; Audit.Tests: InheritedFrom of audit
entries and an item without a SACL; ObjectApis.Tests: an empty DACL.

### NATIVE-HANDLES

16 method(s), 34 unvisited sequence point(s), 6 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Explained.

Classes: IntPtrExtensions, SafeAuthzRMHandle, SafeHGlobalHandle,
SafeTokenHandle.

Evidence: reading the source.

Why: Native memory and handle wrappers. The overloads that the Authz and
descriptor code use run; the unvisited ones have no caller: further
AllocHGlobal overloads, InvalidHandle getters, ReleaseHandle for handles that
the module never creates, and Increment. They wrap Marshal.AllocHGlobal and
FreeHGlobal, so a test would repeat the BCL.

Residual risk: Low.

Related tests: Effective access tests run the used overloads.

### PRIVILEGE-DISABLE-FAILURE

4 method(s), 10 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: BaseCmdletWithPrivControl.

Evidence: reading the source.

Why: These are the failure branches of disabling a privilege. DisablePrivilege
reads the current state first and does nothing unless the privilege is
Enabled, so a privilege that another command disabled, or that the token does
not hold, never reaches them. They run only when AdjustTokenPrivileges fails
for an enabled privilege, for example for an invalid token handle; a test
would have to corrupt the process token.

Residual risk: Low: a failed cleanup is a warning that names the privilege.
The deferred review "failed privilege-disable retry" stays not reproduced.

Related tests: Privileges.Tests: another command disables a privilege, early
pipeline stop, token holds only some privileges.

### PRIVILEGE-ENABLER-RACE

1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: PrivilegeEnabler.

Evidence: reading the source.

Why: The third operand of the condition, that the adjustment returned
PrivilegeModified, is false only when another thread enabled the privilege
between the state check and the adjustment of the same call.

Residual risk: None found.

Related tests: Privileges.Tests: the first and the second enabler, a privilege
that was enabled before, and a privilege that the token does not hold.

### PRIVILEGECONTROL-DEAD-ELSE

2 method(s), 2 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: PrivilegeControl.

Evidence: reading the source.

Why: The unvisited points are the last else of each method, taken when the
third read of the privilege state finds none of Disabled, Removed, or Enabled.
PrivilegeState has exactly these three values and GetPrivilegeState returns
one of them, so the else can run only when another thread changes the
privilege between the reads of one call.

Residual risk: None found: the message would be Unknown Error, for a state
that cannot exist.

Related tests: Privileges.Tests: enabling and disabling a held privilege,
repeating either, and a privilege that the token does not hold.

### READ-RETRY-CLOSURE

4 method(s), 8 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: GetAccess/<>c__DisplayClass20_0, GetInheritance/<>c__DisplayClass7_0,
GetOrphanedAccess/<>c__DisplayClass1_0,
GetSecurityDescriptor/<>c__DisplayClass4_0.

Evidence: reading the source.

Why: The closure re-reads the item inside InvokeAsOwner. InvokeAsOwner reads
the owner first, which needs the same READ_CONTROL right as the read that
failed, so the retry stops before the closure runs; the documentation and
PathErrors assert the resulting ReadSecurityError. A DACL that denies reading
the DACL but not the owner cannot be built.

Residual risk: None found: the closure repeats the first attempt.

Related tests: PathErrors: An item whose owner may not read its permissions.

### REGISTRY-MODEL

34 method(s), 105 unvisited sequence point(s), 20 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Explained.

Classes: RegistryAccessRule2, RegistryEffectivePermissionEntry,
RegistryInheritanceInfo, RegistryKeyOpenException,
RegistryKeySetSecurityException, Win32RegistrySecurity.

Evidence: a static scan of the compiled code.

Why: The registry ACL object model of the original project. No cmdlet accepts
a registry path and no other class of the four assemblies calls it (static IL
scan). SetRegistryOwner takes ownership of registry keys, which no test may do
on the shared host, and the model is not part of the documented module
surface. Decisions 21 and 22 leave these classes to the maintainer.

Residual risk: Untested and undocumented library surface; a script that calls
it has no test behind it. Keep or remove is a maintainer decision.

Related tests: None; see the decision.

### RELATIVE-PATH-EMPTY

1 method(s), 1 unvisited sequence point(s), 1 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: BaseCmdlet.

Evidence: an executed probe.

Why: The unvisited points are the first branch, which replaces an empty path
with the current location. Every caller passes a validated value: each -Path
and -Target parameter of the cmdlets carries ValidateNotNullOrEmpty, which
rejects an empty value and an empty element of an array in both editions
(probe), and the mandatory -Destination of Copy-Item2 and Move-Item2 rejects
an empty string. A cmdlet without -Path passes the current location itself.

Residual risk: None found: only a class derived from the cmdlet base class
could pass an empty path, and it would get the current location.

Related tests: ItemCmdlets.Tests: Get-Item2 resolves ., .., and relative
names.

### REMOVEALL-ACCOUNT-FILTER

6 method(s), 6 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Open.

Classes: FileSystemAccessRule2, FileSystemAccessRule2/<>c__DisplayClass36_0,
FileSystemAccessRule2/<>c__DisplayClass36_1, FileSystemAuditRule2,
FileSystemAuditRule2/<>c__DisplayClass7_0,
FileSystemAuditRule2/<>c__DisplayClass7_1.

Evidence: reading the source.

Why: The methods run: the cmdlets call RemoveFileSystemAccessRuleAll and
RemoveFileSystemAuditRuleAll without an account list. Only the branch for a
non-null list is unvisited, and no cmdlet reaches it. That branch discards the
result of the LINQ Where that should filter the rules, so the account list has
no effect and every explicit entry is removed (the deferred #113 finding); its
predicate, Count() > 1, would also match no account that appears once, so
using the result as it stands would remove nothing.

Residual risk: Library users who pass accounts lose all entries. A test of the
intended behavior would fail; the defect stays with the maintainer (Decision
16 and #113).

Related tests: None for the account list, on purpose; the cmdlets that call
the methods without one are tested.

### TESTPATH-DEAD-CATCH

1 method(s), 6 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: TestPath2.

Evidence: an executed probe.

Why: The catch (FileNotFoundException) is dead: TryGetFileSystemInfo2 returns
false for a missing item and never throws it. The catch
(NotSupportedException) was not reproduced with a colon, wildcard, device,
long or trailing-dot path in either edition (probes); the ArgumentException of
Windows PowerShell for illegal characters is covered.

Residual risk: Low: both branches write $false or an error for a path that
cannot exist.

Related tests: ItemCmdlets.Tests: Test-Path2 with illegal characters and the
debug message.

### TOKEN-NATIVE-FAILURE

6 method(s), 11 unvisited sequence point(s), 10 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: AccessTokenHandle, Privileges, ProcessHandle.

Evidence: an executed probe.

Why: The unvisited points are the branches that throw a Win32Exception when a
native call fails, and the branches for a size query that succeeds, which it
never does. They are OpenProcessToken in the constructor of AccessTokenHandle
(internal; the token of an exited process still opens, probe), CloseHandle in
ReleaseHandle (ProcessHandle is only created with ownsHandle false, so Windows
never releases it, and AccessTokenHandle releases a handle that it opened
itself), LookupPrivilegeValue in GetLuid (the names come from a fixed
dictionary), LookupPrivilegeName in GetPrivilegeName (the LUIDs come from the
token), and the second GetTokenInformation call after the size query. A test
would have to corrupt the token handle of the process or run on a Windows
version that lacks a privilege. The failures that a caller can cause, a handle
without the right to query or to adjust privileges, run in the Privileges
tests.

Residual risk: Low: each branch throws the Win32Exception of the failed call,
the shape that the covered branches assert.

Related tests: Privileges.Tests: a handle that may only query cannot enable a
privilege, and a handle that may only adjust cannot be queried.

### UNUSED-CMDLET-HELPER

2 method(s), 8 unvisited sequence point(s), 4 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Explained.

Classes: BaseCmdlet.

Evidence: a static scan of the compiled code.

Why: A protected helper or an empty override without a caller in the four
assemblies (static IL scan): the System.IO variant of
BaseCmdlet.GetFileSystemInfo, which every cmdlet replaces with
GetFileSystemInfo2, and the empty BaseCmdlet.ProcessRecord that every cmdlet
overrides. Neither can be called from a test without a running cmdlet that
derives from the class, and they stay until the maintainer decides about
unused classes (Decisions 21 and 22). The scan misses generic instantiations:
it called the Extensions.ForEach and GetParent helpers unused although cmdlets
call them, so they are tested directly now (ObjectApis.Tests) and no longer
listed here.

Residual risk: Low: not reachable from a cmdlet.

Related tests: None needed; ObjectApis.Tests runs the public Extensions
helpers.

### WIN32-AUTHZ-FAILURE

4 method(s), 5 unvisited sequence point(s), 5 unvisited explicit
branch point(s). Category: environment-specific. Disposition: Explained.

Classes: Win32.

Evidence: an executed probe.

Why: The unvisited points are the failures of the Authz calls other than the
two answers that the module expects of an unreachable computer, RPC server
unavailable and endpoint not registered, and the failure of the local resource
manager that follows. Every server name that a test can give, an empty one,
one with a space, backslashes, a colon, a bracket, 300 characters, malformed
and well-formed addresses, ends in one of the two expected answers (probe),
and the local resource manager does not fail. A test would need a remote
computer that answers with another error.

Residual risk: Low: the cmdlet reports the exception as
GetEffectiveAccessError, the shape that the covered unresolved-identity case
asserts.

Related tests: Access.Tests: an unresolved identity, a computer that cannot be
reached, names of this computer, an empty name.

### WIN32-LOCAL-NAME-LOOKUP

1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
branch point(s). Category: defensive. Disposition: Explained.

Classes: Win32.

Evidence: reading the source.

Why: The unvisited points are the catch of a NetworkInformationException from
the lookup of the host and domain name of this computer, which returns false.
The lookup reads the local TCP/IP parameters, which this host has, and a test
cannot remove them.

Residual risk: None found: the name is then treated as another computer, with
the warning.

Related tests: Access.Tests: names of this computer, a computer that cannot be
reached, an empty name.

### WIN32-RAW-DESCRIPTOR

2 method(s), 14 unvisited sequence point(s), 2 unvisited explicit
branch point(s). Category: unused by cmdlets. Disposition: Explained.

Classes: Win32.

Evidence: a static scan of the compiled code.

Why: Win32 is an internal class. GetRawSecurityDescriptor is private and has
no caller, and the only caller of GetByteSecurityDescriptor is
GetRawSecurityDescriptor (static IL scan). They read a descriptor from a
handle, which the module does through AlphaFS.

Residual risk: None found: dead code. Removing it is a maintainer decision
(Decisions 21 and 22).

Related tests: None needed.