docs(memory-bank): record the published rc8, its acceptance, and the stable path

rc8 is published (tag c719197, Gallery 2026-10-20 10:40:58Z) and accepted: the
identity check, three matrix cells 1,374/0/12, the suite in 24 runs, the first
lab 245/0/1 per edition, every end state CLEAN. The Memory Bank now says so in
the active context, the progress log, Decision 21, and the deployment notes
(with the published hashes, the chain script that ran the acceptance in 68
minutes, and the lesson that the saved lab machines restore cleanly in two
waves). The tech context points to where the helpers live, because TEMP was
cleaned once, and says that the list of published versions ends at rc7. The
debugging insights get the pattern of a swallowed initialization error, its
seam-free trigger (a computer name of 32,718 characters), and the warning that
came before the error.

The older state paragraphs of the active context shrink to make room.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-19
+last-verified: 2026-10-20
 owner: active-agent
 source: current task evidence
 ---
@@ -9,41 +9,33 @@ source: current task evidence
 
 ## Current focus
 
-State at 2026-10-19 12:30 UTC: Handoff 5 is integrated. The maintainer merged
+State at 2026-10-20 12:40 UTC: 5.0.0-rc8 is published and accepted. The
-pull request #125 (`ai/coverage-unknowns`, `17729d7`) and #124 (Dependabot: the
+maintainer merged #126 (the decisions of 2026-10-19) and #127 (`c719197`: the
-pinned `upload-artifact` and `download-artifact` actions, `354ce04`) into
+fix of the false "no access" of `Get-NTFSEffectiveAccess`, the known limit of
-`master`; CI is green on both. rc7 (`fa0701b`) is still the newest release and
+the hard-link cmdlets in the pages and the CHANGELOG, and the label `rc8`) and
-the manifest still says `rc7`, but `master` is ahead of it by seven product
+tagged `5.0.0-rc8` at about 10:28Z. The CI run `39408140862` passed, and the
-files (the culture comparisons of an identity and of `Get-ChildItem2 -Filter`,
+Gallery has rc8 since 10:40:58Z, GitHub since 10:41:07Z. The identity check
-and the piped `AppliesTo`, Decision 26). The stable build is accepted through
+passed. The lab acceptance of the published bytes passed in one detached driver
-the last prerelease, so rc8 is mandatory. On 2026-10-19 the maintainer decided
+(68 minutes, 10:38 to 11:47Z): three cells 1,374/0/12, the suite in 24 runs on
-the path to stable (Decision 21, "Closing the gate"): rc8 carries the fix of
+six machine classes, the first lab 245/0/1 per edition, every end state CLEAN
-the false "no access" of `Get-NTFSEffectiveAccess`; the hard-link names stay a
+(record `Tests/Lab/Acceptance-2026-10-20-published-rc8.md`, #128). The boundary
-known limit in the release notes; the plain test gaps are closed in a
+of the new error, a computer name of 32,718 characters, holds on Server 2019,
-tests-only round until 2026-11-02; #34 waits for a tester until 2026-11-02;
+2022, 2025, and Windows 11 26H1. Open before the stable pull request: the
-Decisions 22 and 24 are accepted (23: option 3). His #34 follow-up went up on
+tests-only round for the plain gaps (until 2026-11-02), the maintainer's #34
-2026-10-19 at 12:09 UTC; nobody has replied. Next: the fix and the test round.
+decision on that date (no reply to his follow-up of 2026-10-19), and his check
+of `PSGALLERY_API_KEY`. The stable build is new bytes that no lab has run; the
+procedure accepts the last prerelease, so the stable change touches only the
+label, the CHANGELOG, and `$publishedVersions`. Any other product change needs
+rc9 and the same acceptance, about 70 minutes with the chain script.
 
-State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack
+State at 2026-10-10: the maintainer integrated the release-gate stack into
-into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120
+`master` (#116, #120, #118, #119, #121; `fa0701b`, CI green; GitHub closed #117
-(`bdb9981`; it replaced #117, which GitHub closed unmerged when the branch
+unmerged when the branch deletion removed its base, Decision 15) and tagged rc7
-deletion after #116 removed its base, see Decision 15), #118 (`03bef2c`,
+(Gallery 12:30:57Z). The published rc7 passed its lab acceptance the same day
-handoff 1, the paths), #119 (`fa0701b`, handoff 2, the operating-system
+(record `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`). The agent's
-matrix), and #121 (the Memory Bank). He tagged `fa0701b` as `5.0.0-rc7` at about
+delegated decisions of 2026-10-09 and 10 are D1 to D47 in
-12:20Z, and rc7 is published (Gallery 12:30:57Z, GitHub 12:31:09Z); 4.2.6 stays
+`decisions-night-2026-10-09.md` of the session files; the maintainer accepted
-the stable Gallery version. rc7 contains the Phase 2 behavior changes, the path
+Decisions 22 and 24 on 2026-10-19 and decides 23 on 2026-11-02.
-tests and fixes, and the three module fixes of the matrix (`962887a`,
-`fdd7a8b`). The published rc7 passed its lab acceptance (gate 3) on the same
-day, in the matrix and in the first lab, with the counts of the final local
-candidate (record `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`). Stable
-5.0.0 stays gated (Decision 21).
-
-The maintainer asked on 2026-10-09 at 21:21 UTC to continue with the
-release-gate handoffs and to decide and report later. The agent's decisions are
-D1 to D47 in `decisions-night-2026-10-09.md` of the session files. Decisions
-22 (Phase 2), 23 (the #34 dossier), and 24 (the matrix) are proposed: the agent
-confirmed Decision 22 under the delegation, and neither that nor any risk
-acceptance is the maintainer's.
 
 ## Evidence
 
@@ -141,6 +133,15 @@ acceptance is the maintainer's.
   cells did nothing: a `powershell.exe` that PowerShell 7 starts inherits its
   `PSModulePath` (lab README). Server Core, ARM64, a localized system, and
   non-Windows servers are out of scope (Decision 25).
+- rc8, 2026-10-20: fix (b) test-first on `ai/fix-effective-access-init-errors`.
+  A `-ServerName` of 40,000 characters gave `Synchronize` and no error before
+  and gives an error now; two tests were red and are green in four
+  configurations, and the suite has 1,494 cases per configuration, 0 failed.
+  The independent review (`code-review`) found one Minor, the warning "based on
+  this computer" before the error (fixed, with tests), and three Nits. The
+  acceptance evidence is `rc8-published` in the session folder
+  `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns` (430 files, with a
+  manifest); the published hashes are in the deployment notes.
 - Raw evidence is outside git: the session folder
   `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the
   night log) and
@@ -148,19 +149,17 @@ acceptance is the maintainer's.
 
 ## Next step
 
-1. Gate 3 is done for the published rc7 (the record above). rc8 needs the same
+1. Gate 3 is done for the published rc7 and rc8 (the records). The stable build
-   acceptance (the matrix cells, the first lab, the suite on the file servers
+   is accepted through rc8 (Decision 21, "Closing the gate"). Open: keep or
-   and the client); the release procedure accepts the last prerelease for the
+   replace the matrix VMs (about 60 GB, saved between runs) and the evaluation
-   stable build (Decision 21, "Closing the gate").
+   client (it shuts down every hour; `OSWin11E` is off), and a domain cell for
-   Open: keep or replace the matrix VMs (about 60 GB) and the evaluation client
+   Windows 11 26H1, whose client loses the secure channel to the Server 2025
-   (it shuts down every hour; `OSWin11E` is off), and a domain cell for Windows
+   domain controller. `Chain-Published.ps1` in the session files runs the whole
-   11 26H1, whose client loses the secure channel to the Server 2025 domain
+   sequence (not in the kit; deployment notes).
-   controller. A kit script for the whole sequence would make the repetition
+2. The stable pull request: no `Prerelease`, `## [5.0.0] - <date>` with an empty
-   one command (the driver is `Run-Gate3.ps1` in the evidence; not in the kit).
+   `[Unreleased]` and the links, and `5.0.0-rc8` in `$publishedVersions` (the
-2. The rc8 pull request adds `5.0.0-rc7` to `$publishedVersions` (the list ends
+   list ends at rc7 now). The maintainer checks the expiry of
-   at rc6; adding it earlier fails the reuse test, deployment notes), and the
+   `PSGALLERY_API_KEY` first, merges, and tags. Every release step is his.
-   stable pull request adds `5.0.0-rc8`. Every release step is the
-   maintainer's.
 3. He decides the other open items of the paths report: `FileSecurity`
    conversions, `RemoveAll` account filters, lazy path overloads, abandoned
    `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, the 17
@@ -172,20 +171,21 @@ acceptance is the maintainer's.
    chooses between waiting longer and accepting the untested risk with a
    release-note caveat. No agent can accept it.
 5. Of the two LOW findings of the security review (record, Limits), the
-   swallowed initialization errors of `GetEffectiveAccess` (a false "no
+   swallowed initialization errors of `GetEffectiveAccess` are fixed in rc8
-   access" instead of an error on an OS that refuses at initialization) are
+   (`25fe775`, #127): an error instead of a false "no access", and the warning
-   fixed in rc8 (decided 2026-10-19): record the exceptions in
+   only with a result. He still decides the other: the ACL of the stage
-   `authzException`, with a regression test and a check of "the error stays" in
-   the help and CHANGELOG. He still decides the other: the ACL of the stage
    folders under `C:\` in the lab kit (they inherit Authenticated Users:
    Modify; protecting them is a design change of the controller and needs a new
    acceptance). The help could also say that a local standard user who asks
    about a domain account still gets "Access is denied".
 6. Handoff 5 is done and merged (Evidence). Decided on 2026-10-19 (Decision
-   21): the hard-link names under another root (a defect with a reproduction)
+   21): the hard-link names under another root stay a known limit; the pages
-   stay a known limit that the release notes list; the plain test items (68
+   and the CHANGELOG say so since rc8. The plain test items (68 `budget`
-   `budget` mentions in the 57 sets that are not closed) are closed in a
+   mentions in the 57 sets that are not closed) are closed in a tests-only
-   tests-only round until 2026-11-02. Still his: the silent default scope for a
+   round until 2026-11-02: four implementers, one per `ParameterSets.*` test
-   piped `AppliesTo` that PowerShell cannot convert (a design change), the 8
+   file, work in worktrees from `master`; their commits go into one branch
-   getters of pipeline parameters, and the audit paths.
+   with the report and the ParameterSets table updated, and what is left is
+   listed. A defect that a test finds needs his decision and rc9. Still his: the
+   silent default scope for a piped `AppliesTo` that PowerShell cannot convert
+   (a design change), the 8 getters of pipeline parameters, and the audit paths.
 7. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/debugging-insights.md

@@ -1,8 +1,8 @@
 ---
 status: current
-last-verified: 2026-10-10
+last-verified: 2026-10-20
 owner: software-engineer
-source: Handoff 5 (the coverage unknowns): probes, red and green runs, and the independent review
+source: Handoff 5 (the coverage unknowns) and the rc8 fix: probes, red and green runs, and the independent reviews
 ---
 
 # Debugging insights
@@ -90,3 +90,28 @@ fails without it (Decision 16).
   `AppliesTo` was optional; `4b1abc9` made it mandatory in the Simple sets, so
   the default no longer decided a named call. Build a model of the parameter
   sets before you change an attribute, and test the real cmdlet afterwards.
+
+## A swallowed initialization error (`catch { }`)
+
+- `Win32.GetEffectiveAccess` ran the start of the authorization manager inside
+  an outer `catch { }`. A refusal there gave no exception and no rights, so the
+  cmdlet wrote an entry with `Synchronize` only (.NET adds it to every allow
+  rule) and no error: a false "no access". The security review of the matrix
+  found it (LOW); rc8 fixed it (`25fe775`) with one `try`/`catch` that records
+  every exception in `authzException`.
+- A trigger without a test seam: `Get-NTFSEffectiveAccess -ServerName ('a' *
+  40000)`. `AuthzInitializeRemoteResourceManager` fails with error 14 for a name
+  of 32,718 characters or more, and with 1722 (RPC server unavailable, which
+  keeps the documented fallback and its warning) for a shorter one. Server
+  2019, 2022, 2025, and Windows 11 26H1 agree (a probe in the rc8 record). Bisect
+  the length of an input before you add a seam.
+- The test accepts both outcomes (an error, or the result of this computer) and
+  fails for no access without an error: the red run said `Expected FullControl,
+  but got Synchronize`. A system-dependent boundary must not fail the test where
+  a system answers like for a short name.
+- The review found a second flaw in the same output: the warning "the result is
+  based on this computer" came before an error that left no result. A warning
+  that qualifies a result belongs with the result (`!FromRemote &&
+  !OperationFailed`); the tests assert its absence next to the error.
+- A word in the CHANGELOG is a claim: "an overlong name" suggested 256
+  characters, where 1722 still falls back. The entry names the probed length.

.memory-bank/decisions/0021-quality-gate-before-5.0.0.md

@@ -1,9 +1,9 @@
 ---
 status: accepted
 date: 2026-10-08
-last-verified: 2026-10-19
+last-verified: 2026-10-20
 owner: shared
-source: maintainer decision of 2026-10-08; closing choices of 2026-10-19
+source: maintainer decision of 2026-10-08; closing choices of 2026-10-19; status of 2026-10-20
 ---
 
 # Decision 21: A quality gate before 5.0.0
@@ -69,3 +69,17 @@ maintainer answered five questions, each time with the recommended option:
   `$publishedVersions`), the tag. The maintainer checks the expiry of
   `PSGALLERY_API_KEY` before the stable tag. After 5.0.0 the repository is
   archived (Decision 18), so what ships stays.
+
+### Status on 2026-10-20
+
+rc8 is published (tag `c719197`, Gallery 10:40:58Z) and accepted: the identity
+check, three matrix cells 1,374/0/12, the suite in 24 runs, the first lab
+245/0/1 per edition, every end state CLEAN (record
+`Tests/Lab/Acceptance-2026-10-20-published-rc8.md`). The fix of the swallowed
+initialization errors went in with a review (one Minor, the warning before the
+error, fixed), and the hard-link known limit is in the pages and the
+CHANGELOG. The exit criterion "matrix on published bytes" is met for rc8; open
+are the tests-only round (until 2026-11-02), #34 (2026-11-02), and the key
+check. The stable build is new bytes: the stable change may touch only the
+label, the CHANGELOG, and `$publishedVersions`; any other product change needs
+rc9 and the same acceptance.

.memory-bank/deployment-notes.md

@@ -1,32 +1,36 @@
 ---
 status: current
-last-verified: 2026-10-10
+last-verified: 2026-10-20
 owner: software-engineer
 source: release gates of 5.0.0 (lab acceptance, OS matrix, publication plan), repository evidence
 ---
 
 # Deployment notes
 
-## Publish the next prerelease (rc7 is published)
+## Publish the next prerelease (rc8 is published)
 
-State on 2026-10-10 at 12:40 UTC: rc7 is published. The whole stack is merged
+State on 2026-10-20 at 12:40 UTC: rc8 is published. #127 (`c719197`, 10:27:39Z:
-into `master` (`fa0701b`, the tree of `2b8643f`): #116 (rc7, `8a6be9f`, 09:10Z),
+the fix of `Get-NTFSEffectiveAccess`, the hard-link known limit, the label
-#120 (`bdb9981`, 10:50Z), #118 (`03bef2c`, 11:12Z), and #119 (`fa0701b`,
+`rc8`) and #126 are merged. The maintainer pushed the lightweight tag
-11:28Z). #117 had been closed without a merge at 09:10:16Z, when the branch
+`5.0.0-rc8` at `c719197` at about 10:28Z. The CI run `39408140862` of the tag
-deletion after the merge of #116 removed its base branch (Decision 15,
+passed: Build and test, then Release without an approval step, because the
-operating rule); #120, a new pull request from its head `f11ff41`, replaced
+`powershell-gallery` environment has no required reviewer. The Gallery has rc8
-it. The CI run on `master` at `fa0701b` passed at 11:40Z. The maintainer pushed
+since 10:40:58Z, GitHub since 10:41:07Z, 13 minutes after the tag.
-the lightweight tag `5.0.0-rc7` at `fa0701b` at about 12:20Z. The CI run
+`Test-PublishedRelease.ps1 -Version 5.0.0-rc8` verified the identity at 10:42Z:
-`38051611526` of the tag passed: Build and test, then Release at 12:31:34Z
+the tag commit is on `master`, the Gallery's SHA-512 matches the downloaded
-without an approval step, because the `powershell-gallery` environment has no
+nupkg, the 11 module files are byte-identical in the nupkg and the GitHub zip,
-required reviewer. The Gallery has rc7 since 12:30:57Z, GitHub since 12:31:09Z.
+and the manifest says `5.0.0-rc8`. The published bytes of rc8:
 
-`Test-PublishedRelease.ps1 -Version 5.0.0-rc7` verified the published identity
+- `NTFSSecurity.dll` SHA-256
-at 12:33Z: the tag commit is `fa0701b` on `master`, the Gallery's SHA-512
+  `D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79`
-matches the downloaded nupkg, the 11 module files are byte-identical in the
+- `NTFSSecurity.zip` SHA-256
-nupkg and the GitHub zip, and the manifest says `5.0.0-rc7`. The evidence is
+  `288152E20F8CFB1B029BAC055345339970C65BD57C8BA814C2616C32D9F812BC`
-outside git, in `published-rc7` of the session folder
+- nupkg SHA-256
-`4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files`. The published bytes:
+  `EA90E16F2152016E97BFB3D2413D29F8944704E9D4FBD5101D0A263841BC0510`
+
+rc7 was published on 2026-10-10 (tag `fa0701b`, CI run `38051611526`, Gallery
+12:30:57Z, no approval step after the same stack of merges, see `progress.md`).
+Its bytes:
 
 - `NTFSSecurity.dll` SHA-256
   `D3B7CBE362C37D1016559669CB2EFF5034A6945CA1B03DDB49F1361363D203A7`
@@ -38,23 +42,16 @@ outside git, in `published-rc7` of the session folder
 The release notes of a prerelease are the `[Unreleased]` section of
 `CHANGELOG.md`.
 
-rc7 contains everything that is merged: the behavior changes of Phase 2
+1. Accept the published package (next section): done for rc7 (2026-10-10) and
-(#116), the quality-gate paths (#120, #118), and the three module fixes of
+   rc8 (2026-10-20); the records are `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`
-the matrix (#119, in two commits: `962887a` holds two, `fdd7a8b` one; they
+   and `Tests/Lab/Acceptance-2026-10-20-published-rc8.md`. A changed binary (rc9,
-don't revert separately, because they conflict in `Security2/Win32/Lib.cs` and
+   or a build of 5.0.0 that differs by more than the label) needs the same
-`CHANGELOG.md`), with the kit, the controller changes, and the record of the
+   cells again.
-operating-system matrix (Decision 24).
+2. The stable change adds `5.0.0-rc8` to `$publishedVersions` in
-
+   `Tests/Repository.Tests.ps1` (the list ends at rc7), as
-1. Accept the published package (next section): done for rc7 on 2026-10-10,
-   with the identity check, the three cells, the suite on six machine classes,
-   and the first lab (record
-   `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`).
-   A changed binary (rc8, or the build of 5.0.0) needs the same cells again.
-2. Add `5.0.0-rc7` to `$publishedVersions` in `Tests/Repository.Tests.ps1`
-   only in the change that sets the next version (rc8 or 5.0.0), as
    `Docs/Contributing/05-Releasing.md` says. The test "Should not reuse a
    version that the PowerShell Gallery already has" fails when the list holds
-   the version of the manifest, which still says rc7.
+   the version of the manifest.
 
 ## Accept a published package
 
@@ -79,15 +76,22 @@ Local `-ModulePath` runs are validation; the gate needs the published bytes.
    the final local candidate through the same stages (readiness, controller,
    `Validate-LabResults.ps1`, snapshot, `-RemoveFixture`, `Test-MatrixCleanup.ps1`
    with the four domain controllers and both machines) in one detached driver.
-   The published rc7 ran in one detached driver in this order (61 minutes,
+   Published rc7 and rc8 ran in one detached driver each: the cells, then
-   14:29 to 15:30Z, `OSWin11E` started 14:25:49Z): the cells, then
    `Run-MatrixLocalSuite.ps1 -ModulePath <zip-<version>\NTFSSecurity of the
    identity check> -Mode Elevated,Basic` on the host and five machines (one
    every 75 seconds: AutomatedLab imports one lab at a time), then
    `Test-MatrixCleanup.ps1 -Mode Verify` (CLEAN at the first check, so the
    cells first and the suites after them leave nothing to repair), then the
-   first lab. The driver is `Run-Gate3.ps1` in the evidence folder `gate3-rc7`
+   first lab. rc8 used `Chain-Published.ps1 -Version 5.0.0-rc8 -Tag rc8
-   of the session files; it only calls these scripts and isn't in the kit.
+   -Evidence <folder>` (session files `qg-unknowns\scripts`, not in the kit;
+   68 minutes, 10:38 to 11:47Z). It restores the saved machines of both labs
+   (`Start-LabMachines.ps1`: domain controllers first, a minute for the
+   directory services), waits for the version on the Gallery, freezes the files
+   of the tag in a worktree, runs the identity check and the readiness checks,
+   starts `OSWin11E` right before the cells, and ends with the first lab
+   (`Run-LiveAcceptancePublished.ps1`, `-Version` per edition) and a read-only
+   check of both labs. Launch it after the tag, arm a heartbeat, and save the
+   machines again when it is done. rc7 ran the older `Run-Gate3.ps1`.
 3. Remove the fixture and check the end state independently with
    `Test-MatrixCleanup.ps1`, which takes the lab name and the machine names
    (`-LabName WindowsAccessControlLab -DomainController F1ADC1, F1BDC1, F2DC1,
@@ -181,3 +185,8 @@ Local `-ModulePath` runs are validation; the gate needs the published bytes.
 - Restart the evaluation client (`OSWin11E`) right before a sequence or a suite,
   not before several: it shuts down an hour after each start. The restart takes
   about two and a half minutes and may need the repair of the secure channel.
+- The lab VMs stay saved (`Save-VM`) between runs. After nine days, a restore in
+  two waves (the domain controllers, a minute for the directory services, then
+  the other machines) passed the readiness checks of both labs at the first
+  attempt, about five minutes after the start. `Start-LabMachines.ps1` restores
+  them, and `Save-VM` puts them back after the run.

.memory-bank/progress.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-19
+last-verified: 2026-10-20
 owner: active-agent
 source: repository and validation evidence
 ---
@@ -9,16 +9,17 @@ source: repository and validation evidence
 
 ## Current status
 
-5.0.0-rc7 is published on the Gallery and GitHub (2026-10-10, tag at
+5.0.0-rc8 is published on the Gallery and GitHub (2026-10-20, tag at
-`fa0701b`); rc6 is the one before it. On 2026-10-10 the maintainer merged the
+`c719197`); rc7 (2026-10-10, tag at `fa0701b`) is the one before it. On
-whole stack into `master` (CI green): #116 (rc7), #120 (it replaced
+2026-10-10 the maintainer merged the whole stack into `master` (CI green): #116
-#117, which GitHub closed unmerged when the branch deletion after #116 removed
+(rc7), #120 (it replaced #117, which GitHub closed unmerged when the branch
-its base), #118 (the quality-gate paths), #119 (the operating-system matrix
+deletion after #116 removed its base), #118 (the quality-gate paths), #119 (the
-with three module fixes, Decision 24), and #121 (the Memory Bank). The
+operating-system matrix with three module fixes, Decision 24), and #121 (the
-published rc7 passed its lab acceptance (gate 3) in the matrix and in the first
+Memory Bank). On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot) and
-lab. On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot), and decided
+decided the path to stable (Decision 21, "Closing the gate"); on 2026-10-20 he
-the path to stable (Decision 21, "Closing the gate"). Stable Gallery version:
+merged #126 (the decisions) and #127 (the rc8 fix and label) and tagged rc8.
-4.2.6.
+The published rc7 and rc8 passed their lab acceptance in the matrix and in the
+first lab. Stable Gallery version: 4.2.6.
 After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 
 ## Recent milestones
@@ -117,6 +118,19 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   accepted, 23 option 3 with the decision date 2026-11-02 (the #34 follow-up
   went up at 12:09 UTC), rc8 with the fix of `GetEffectiveAccess`, and a
   tests-only round for the plain test gaps until 2026-11-02.
+- 2026-10-20: rc8. The maintainer merged #126 and #127 (`c719197`: the fix of
+  the swallowed initialization errors of `GetEffectiveAccess`, the known limit
+  of the hard-link cmdlets in the pages and the CHANGELOG, label `rc8`) and
+  tagged `5.0.0-rc8` at about 10:28Z; Gallery 10:40:58Z, GitHub 10:41:07Z, no
+  approval step. The identity check passed (10:42Z). The lab acceptance of the
+  published bytes ran in one detached chain (68 minutes, 10:38 to 11:47Z, the
+  saved machines restored first): three cells 1,374 passed, 0 failed, 12
+  skipped; the suite in 24 runs without a failure (1,191 cases per
+  configuration); the first lab 245/0/1 per edition; every end state CLEAN. A
+  probe on four operating systems showed the boundary of the new error (a name
+  of 32,718 characters). Record
+  `Tests/Lab/Acceptance-2026-10-20-published-rc8.md` (#128). The tests-only
+  round for the plain gaps started the same day.
 
 ## Stable capabilities
 
@@ -129,12 +143,12 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 
 ## Open work
 
-1. Decision 21 gate: the published rc7 is accepted in the matrix and the first
+1. Decision 21 gate: the published rc7 and rc8 are accepted in the matrix and
-   lab (record); rc8 needs the same acceptance, and stable follows it
+   the first lab (records); stable follows rc8 (Decision 21, "Closing the
-   (Decision 21, "Closing the gate"). Do not release 5.0.0 until the other
+   gate"). Do not release 5.0.0 until the other gates close: the tests-only
-   gates close. Release steps:
+   round, #34 on 2026-11-02, and the key check. Release steps:
    `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date
-   `[5.0.0]`, add the last prerelease to `$publishedVersions` (never the
+   `[5.0.0]`, add the last prerelease (rc8) to `$publishedVersions` (never the
    version of the manifest), tag through CI.
 2. Issues: #110's seven items were addressed by rc6, but #115 deliberately
    used no closing keyword. #34 stays open for non-Windows owner feedback
@@ -170,8 +184,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    missing, different, or unverifiable outcomes. The agent published nothing,
    so the recovery has never run against the Gallery.
 9. Operating-system matrix (Decision 24, accepted 2026-10-19): the lab and the
-   cells exist and the published rc7 passes them (record). #34: the follow-up
+   cells exist and the published rc7 and rc8 pass them (records). #34: the
-   went up on 2026-10-19, no reply yet; the decision date is 2026-11-02.
+   follow-up went up on 2026-10-19, no reply yet; the decision date is
+   2026-11-02.
 10. Lab rollback evidence: new checkpoints report Standard even after a
     successful temporary ProductionOnly probe; original VM policy restored, no
     checkpoint restored. Don't represent them as verified Production snapshots.

.memory-bank/techContext.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-10
+last-verified: 2026-10-20
 owner: active-agent
 source: repository and executable evidence
 ---
@@ -42,9 +42,9 @@ source: repository and executable evidence
 
 ## Constraints
 
-- Manifest: ModuleVersion 5.0.0, prerelease rc7, published 2026-10-10 (tag at
+- Manifest: ModuleVersion 5.0.0, prerelease rc8, published 2026-10-20 (tag at
-  `fa0701b`). Latest stable 4.2.6. The reuse test fails if `$publishedVersions`
+  `c719197`). Latest stable 4.2.6. `$publishedVersions` ends at rc7; the reuse
-  holds the manifest's version: add rc7 in the change that sets the next one.
+  test fails if it holds the manifest's version, so the stable change adds rc8.
 - Changed-section writes preserve unchanged owner/group/DACL/SACL (19).
   Roots use root-folder APIs, not AlphaFS device security (#41).
 - CHANGELOG contains user-visible changes only (7); tests and CI-only fixes
@@ -67,11 +67,12 @@ source: repository and executable evidence
   `Start-DetachedPowerShell.ps1`; use unique TEMP logs/result paths and an
   explicit-PID watcher. No foreground sleep/poll loop. Long payloads use
   a script file: nested Base64 encoding can exceed Windows command limits.
-- Focused helper: TEMP `ntfs-focused\Start-FocusedRuns.ps1`; detach that
+- Helpers live in the session folder `qg-unknowns\scripts`, not in TEMP (TEMP was
-  driver too because its internal wait loop must not block the agent shell.
+  cleaned once): `Invoke-Build.ps1`, `Start-FocusedRuns.ps1` (four
-- TEMP `ntfs-docs-tools\Invoke-ChangeChecks.ps1 -File <relative paths>`
+  configurations), `Run-FullSuite.ps1` (the CI test steps), `Check-Docs.ps1`.
-  performs AST/analyzer/lint/help checks. Absolute input paths misroute
+  Restore the pinned compiler (Microsoft.Net.Compilers 4.2.0 from NuGet) into
-  cmdlet pages. Check actual analyzer/lint output, not just helper exit.
+  TEMP `ntfs-build` and platyPS 0.14.2 and MarkdownLinkCheck 0.2.0 (`Save-Module`
+  in Windows PowerShell) into TEMP `ntfs-docs-tools\modules`.
 - actionlint 1.7.12 checks the workflow. Script changes use AST parse and
   PSScriptAnalyzer; prose Markdown uses MD013 and changelog siblings-only
   repeated-heading allowance. Native error codes must be checked explicitly.