Merge pull request #126 from raandree/ai/stable-release-plan

docs(memory-bank): record the decisions on the path to stable 5.0.0

.memory-bank/activeContext.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-11
+last-verified: 2026-10-19
 owner: active-agent
 source: current task evidence
 ---
@@ -9,22 +9,20 @@ source: current task evidence
 
 ## Current focus
 
-State at 2026-10-11 13:50 UTC: Handoff 5 (the coverage unknowns) is done
-locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; the
-maintainer pushed the branch at `2b97422`, and the later commits are local.
-The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` with nine
-CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence points. Three
-defects are fixed test-first: two `tr-TR` comparisons (`419cfb3`; `0028ccd`,
-`fbe0289`, `8a625c8`) and the piped `AppliesTo` that a path dropped (`93ed2c7`,
-`9783d2a`: no default parameter set for Add and Remove of access and audit,
-Decision 26); one defect is open (hard-link names under a root that is not the
-volume root). 101 new `It` blocks; at `2112ee3` (product code built once at
-`9783d2a`): 1,492 cases per configuration, 3,266/3,668 points. The final
-package passed in the labs (first lab 245/0/1 per edition; the suite on the file
-servers and the client, 16 configurations; the three cells 229/0/2 per
-edition), every end state clean. Three independent reviews and two checks read
-the work, with no Blocker. The maintainer decides whether the fixes and the
-tests enter a new candidate.
+State at 2026-10-19 12:30 UTC: Handoff 5 is integrated. The maintainer merged
+pull request #125 (`ai/coverage-unknowns`, `17729d7`) and #124 (Dependabot: the
+pinned `upload-artifact` and `download-artifact` actions, `354ce04`) into
+`master`; CI is green on both. rc7 (`fa0701b`) is still the newest release and
+the manifest still says `rc7`, but `master` is ahead of it by seven product
+files (the culture comparisons of an identity and of `Get-ChildItem2 -Filter`,
+and the piped `AppliesTo`, Decision 26). The stable build is accepted through
+the last prerelease, so rc8 is mandatory. On 2026-10-19 the maintainer decided
+the path to stable (Decision 21, "Closing the gate"): rc8 carries the fix of
+the false "no access" of `Get-NTFSEffectiveAccess`; the hard-link names stay a
+known limit in the release notes; the plain test gaps are closed in a
+tests-only round until 2026-11-02; #34 waits for a tester until 2026-11-02;
+Decisions 22 and 24 are accepted (23: option 3). His #34 follow-up went up on
+2026-10-19 at 12:09 UTC; nobody has replied. Next: the fix and the test round.
 
 State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack
 into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120
@@ -150,43 +148,44 @@ acceptance is the maintainer's.
 
 ## Next step
 
-1. Gate 3 is done for the published rc7 (the record above). A changed binary
-   (rc8, or the build of 5.0.0) needs the same cells again; the release
-   procedure accepts the last prerelease for the stable build (his decision).
+1. Gate 3 is done for the published rc7 (the record above). rc8 needs the same
+   acceptance (the matrix cells, the first lab, the suite on the file servers
+   and the client); the release procedure accepts the last prerelease for the
+   stable build (Decision 21, "Closing the gate").
    Open: keep or replace the matrix VMs (about 60 GB) and the evaluation client
    (it shuts down every hour; `OSWin11E` is off), and a domain cell for Windows
    11 26H1, whose client loses the secure channel to the Server 2025 domain
    controller. A kit script for the whole sequence would make the repetition
    one command (the driver is `Run-Gate3.ps1` in the evidence; not in the kit).
-2. The change that sets the next version (rc8 or 5.0.0) adds `5.0.0-rc7` to
-   `$publishedVersions`; adding it earlier fails the reuse test (deployment
-   notes). Every release step is the maintainer's.
-3. He decides the open items of the paths report: `FileSecurity` conversions,
-   `RemoveAll` account filters, lazy path overloads, abandoned
+2. The rc8 pull request adds `5.0.0-rc7` to `$publishedVersions` (the list ends
+   at rc6; adding it earlier fails the reuse test, deployment notes), and the
+   stable pull request adds `5.0.0-rc8`. Every release step is the
+   maintainer's.
+3. He decides the other open items of the paths report: `FileSecurity`
+   conversions, `RemoveAll` account filters, lazy path overloads, abandoned
    `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, the 17
    owner-restore handlers without the later-command check, unused classes
-   (Decisions 21/22). He also confirms or changes the proposed Decisions 22 and
-   24.
-4. #34 stays open (Decision 23; no reply since 2026-10-06): the maintainer
-   chooses between waiting for a test of the published candidate on the
-   NetApp, EMC, and IBM ESS servers of the reporters (checklist:
-   `Tests/Lab/Non-Windows-File-Server-Test.md`) and accepting the untested
-   risk with a release-note caveat. No agent can accept it.
-5. He decides the two LOW findings of the security review (record, Limits):
-   the swallowed initialization errors of `GetEffectiveAccess` (a false "no
-   access" instead of an error on an OS that refuses at initialization; fix:
-   record the exceptions in `authzException`, with a regression test and a
-   check of "the error stays" in the help and CHANGELOG), and the ACL of the
-   stage folders under `C:\` in the lab kit (they inherit Authenticated Users:
+   (Decisions 21/22). Decisions 22 and 24 are accepted (2026-10-19).
+4. #34 waits for a tester until 2026-11-02 (Decision 23, option 3; the
+   follow-up went up on 2026-10-19, no reply yet; checklist:
+   `Tests/Lab/Non-Windows-File-Server-Test.md`). On that date the maintainer
+   chooses between waiting longer and accepting the untested risk with a
+   release-note caveat. No agent can accept it.
+5. Of the two LOW findings of the security review (record, Limits), the
+   swallowed initialization errors of `GetEffectiveAccess` (a false "no
+   access" instead of an error on an OS that refuses at initialization) are
+   fixed in rc8 (decided 2026-10-19): record the exceptions in
+   `authzException`, with a regression test and a check of "the error stays" in
+   the help and CHANGELOG. He still decides the other: the ACL of the stage
+   folders under `C:\` in the lab kit (they inherit Authenticated Users:
    Modify; protecting them is a design change of the controller and needs a new
    acceptance). The help could also say that a local standard user who asks
    about a domain account still gets "Access is denied".
-6. Handoff 5 is done (Evidence). The maintainer decides whether the fixes
-   (`419cfb3`, `0028ccd`, `fbe0289`, `8a625c8`, `93ed2c7`, `9783d2a`) and the
-   tests enter a new candidate (rc8), which needs the matrix cells and the
-   first lab on its own bytes, and he decides the open items of the report:
-   hard-link names under another root (a defect with a reproduction), the
-   silent default scope for a piped `AppliesTo` that PowerShell cannot convert
-   (a design change), 8 getters of pipeline parameters, the 51 partly closed
-   sets, and the audit paths.
+6. Handoff 5 is done and merged (Evidence). Decided on 2026-10-19 (Decision
+   21): the hard-link names under another root (a defect with a reproduction)
+   stay a known limit that the release notes list; the plain test items (68
+   `budget` mentions in the 57 sets that are not closed) are closed in a
+   tests-only round until 2026-11-02. Still his: the silent default scope for a
+   piped `AppliesTo` that PowerShell cannot convert (a design change), the 8
+   getters of pipeline parameters, and the audit paths.
 7. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/decisions/0021-quality-gate-before-5.0.0.md

@@ -1,9 +1,9 @@
 ---
 status: accepted
 date: 2026-10-08
-last-verified: 2026-10-08
+last-verified: 2026-10-19
 owner: shared
-source: maintainer decision of 2026-10-08
+source: maintainer decision of 2026-10-08; closing choices of 2026-10-19
 ---
 
 # Decision 21: A quality gate before 5.0.0
@@ -35,3 +35,37 @@ source: maintainer decision of 2026-10-08
   (Decision 16); so do the 244 lines of classes that no cmdlet calls, the
   operating systems of Phase 3, and how to cover file servers that aren't
   Windows (#34).
+
+## Closing the gate (maintainer, 2026-10-19)
+
+After Handoff 5 and the merges of #125 and #124 (`master` at `354ce04`), the
+maintainer answered five questions, each time with the recommended option:
+
+- rc8 is the next prerelease and carries `master`, which is ahead of rc7 by the
+  seven product files of #125. Stable 5.0.0 is accepted through the last
+  prerelease (`Docs/Contributing/05-Releasing.md`), so rc8 is mandatory.
+- Code before rc8: fix the false "no access" of `Get-NTFSEffectiveAccess` (the
+  swallowed initialization errors, a LOW finding of the security review),
+  test-first, with an independent review. The hard-link names under a root that
+  is not the volume root stay a known limit that the release notes list (the
+  exit criterion allows "fixed, or accepted and listed"). The other open items
+  of the paths report and of Handoff 5 are not decided yet.
+- Test gaps: the plain test items that the ParameterSets table marks `budget`
+  (68 mentions in the 57 sets that are not closed) are closed in a round of
+  tests only, time-boxed to 2026-11-02; the report lists what is left. The
+  shipped DLL does not change by it. A defect that a test finds needs its own
+  decision and a new prerelease.
+- #34: wait for a tester until 2026-11-02, then choose between waiting longer
+  and accepting the untested risk (Decision 23, option 3).
+- Decisions 22 and 24 are accepted (their records).
+- A tester's result on rc7 counts for rc8 only while no change of rc8 touches
+  the code that writes a section of a security descriptor (Decision 19). The
+  seven product files of #125 have no such line, and the fix of
+  `Get-NTFSEffectiveAccess` reads.
+- Path to stable: the rc8 pull request (label `rc8`, `5.0.0-rc7` into
+  `$publishedVersions`, changelog), the tag, the acceptance of the published
+  rc8 (matrix cells, first lab, suite on the four machines), the stable pull
+  request (no `Prerelease`, `## [5.0.0] - <date>`, `5.0.0-rc8` into
+  `$publishedVersions`), the tag. The maintainer checks the expiry of
+  `PSGALLERY_API_KEY` before the stable tag. After 5.0.0 the repository is
+  archived (Decision 18), so what ships stays.

.memory-bank/decisions/0022-phase-2-behavior-changes.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-08
-last-verified: 2026-10-09
+last-verified: 2026-10-19
 owner: shared
-source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09
+source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09; accepted by the maintainer on 2026-10-19
 ---
 
 # Decision 22: The behavior changes of Phase 2
@@ -51,8 +51,7 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c
   (3); the conventions of .NET and PowerShell (4, 9); no implicit creation
   of folders (10; `Copy-Item` creates them for a folder, see the correction
   below).
-- Open: the maintainer accepts or reverts each choice; then this record
-  becomes `accepted`.
+- Accepted by the maintainer on 2026-10-19 (see the end of this record).
 
 ## Confirmed under delegation, 2026-10-09
 
@@ -104,4 +103,8 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c
   the help from `Docs`, adjust the changelog and the cmdlet page, and run
   the four test configurations again; a later commit on the same page or
   test can conflict.
-- Open: the maintainer confirms (`accepted`) or reverts each item.
+- Accepted: on 2026-10-19 the maintainer answered "Confirm all ten" to the
+  question about these ten choices, which listed the ten and marked 7 and 8 as
+  breaking. The confirmation of 2026-10-09 under his delegation is superseded.
+  After 5.0.0 the changes are permanent, because the repository is archived
+  (Decision 18).

.memory-bank/decisions/0023-non-windows-file-servers.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-09
-last-verified: 2026-10-09
+last-verified: 2026-10-19
 owner: shared
-source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC
+source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC; option 3 chosen by the maintainer on 2026-10-19
 ---
 
 # Decision 23: Non-Windows file servers before 5.0.0 (#34)
@@ -58,8 +58,16 @@ source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-1
   was tested on Windows file servers. NetApp, EMC, and IBM ESS file servers
   weren't available for 5.0.0. If a command still fails there with error
   1307, tell us in #34. `icacls` is the fallback."
-- Open: the maintainer's choice between the options, and the date. Until
-  then the gate of Decision 21 for #34 is open.
+- Chosen (maintainer, 2026-10-19): option 3, with the decision date
+  2026-11-02, 14 days after the follow-up. He posted a follow-up on #34 on
+  2026-10-19 at 12:09 UTC, adapted from the draft below: it asks for the newest
+  prerelease (then rc7), links the checklist on `master`, and names no date. A
+  tester's result on rc7 counts for rc8 while no change of rc8 touches the
+  code that writes a section (Decision 21, "Closing the gate"). The gate of
+  Decision 21 for #34 stays open: no tester has reported, and no risk is
+  accepted. On 2026-11-02 the maintainer chooses between waiting longer
+  (option 1) and accepting the untested risk with the caveat below (option 2).
+  No answer keeps the gate open.
 - Tester checklist: `Tests/Lab/Non-Windows-File-Server-Test.md`. It uses a
   new folder that the tester controls and asks for sanitized evidence.
 - Draft comment for #34 (for the maintainer to post; the agent posts

.memory-bank/decisions/0024-os-matrix-lab.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-09
-last-verified: 2026-10-10
+last-verified: 2026-10-19
 owner: shared
-source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3
+source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3; confirmed by the maintainer on 2026-10-19
 ---
 
 # Decision 24: The operating-system matrix lab
@@ -141,12 +141,13 @@ source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff
   counts: the three cells (1,374 passed, 0 failed, 12 skipped), the suite in 24
   runs, and the first lab with case 9 (245 / 0 / 1 per edition); see
   [its record](../../Tests/Lab/Acceptance-2026-10-10-published-rc7.md).
-- Open: the maintainer confirms or changes the matrix and decides whether to
-  keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the release
-  procedure accepts the last prerelease; a changed binary needs the same cells
-  again. The newest Windows 11 build that can join a Server 2025 domain here is
-  22H2; a domain cell with 26H1 needs a newer domain controller build or a fix
-  of the mismatch. All three module fixes went into rc7 (#119; `962887a` holds
-  two, `fdd7a8b` one, and they don't revert separately). The maintainer also
-  decides whether the evaluation client stays (it needs a start shortly before
-  every run) or is replaced by a client with a license that doesn't expire.
+- Accepted: the maintainer confirmed the matrix as it is on 2026-10-19. Open:
+  whether to keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the
+  release procedure accepts the last prerelease; a changed binary needs the
+  same cells again. The newest Windows 11 build that can join a Server 2025
+  domain here is 22H2; a domain cell with 26H1 needs a newer domain controller
+  build or a fix of the mismatch. All three module fixes went into rc7 (#119;
+  `962887a` holds two, `fdd7a8b` one, and they don't revert separately). The
+  maintainer also decides whether the evaluation client stays (it needs a start
+  shortly before every run) or is replaced by a client with a license that
+  doesn't expire.

.memory-bank/progress.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-11
+last-verified: 2026-10-19
 owner: active-agent
 source: repository and validation evidence
 ---
@@ -14,9 +14,11 @@ source: repository and validation evidence
 whole stack into `master` (CI green): #116 (rc7), #120 (it replaced
 #117, which GitHub closed unmerged when the branch deletion after #116 removed
 its base), #118 (the quality-gate paths), #119 (the operating-system matrix
-with three module fixes, Decision 24 proposed), and #121 (the Memory Bank). The
+with three module fixes, Decision 24), and #121 (the Memory Bank). The
 published rc7 passed its lab acceptance (gate 3) in the matrix and in the first
-lab. Stable Gallery version: 4.2.6.
+lab. On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot), and decided
+the path to stable (Decision 21, "Closing the gate"). Stable Gallery version:
+4.2.6.
 After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 
 ## Recent milestones
@@ -48,14 +50,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 - 2026-10-09: release attempt 2 succeeded; rc6 GitHub prerelease and zip
   appeared at 07:01:34 UTC. #116 passed CI on `d25647d`.
 - 2026-10-09: autonomous follow-up on `ai/quality-gate-coverage` (#117, then
-  #120), through `3442194`: 202 cases above rc7 (deletion/owner failures, all
-  13 scopes, inheritance transitions, enumeration, forced replacement,
-  descriptor failures, offline CI recovery); fixed rooted result paths and the
-  first-hidden-item omission; publication recovery verifies the exact SHA-512
-  identity, not merely the version. Suite: 914 per configuration, zero
+  #120), through `3442194`: 202 cases above rc7; fixed rooted result paths and
+  the first-hidden-item omission; publication recovery verifies the exact
+  SHA-512 identity, not merely the version. Suite: 914 per configuration, zero
   failures; 2,641/3,559 sequence points (74.21%), 974/1,933 branches (50.39%).
-  Live comparison, 09:20 to 09:51 UTC: candidate 330 passed, 0 failed, 2
-  expected skips; published rc6 only its four expected failures (`7594e0c`).
+  Live comparison: candidate 330 passed, 0 failed, 2 expected skips (`7594e0c`).
 - 2026-10-09: handoff 1 (#118): suite 914 to 1,310 per configuration, zero
   failures; 3,192/3,634 sequence points (87.84%), 1,273/1,978 branches; all 231
   unvisited methods classified (223 explained, 8 open). Eleven defects fixed,
@@ -75,11 +74,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   suite on every machine (24 runs), the live controller in three cells (1,374
   passed, 0 failed, 12 skipped), and the first lab with case 9 (245 passed, 0
   failed, 1 skipped per edition). The Server 2022 effective-access failures
-  were stale account state, not the module (a replay; the Windows mechanism is
-  unknown); the controller names the case-3 account anew (`1dec389`). Built-in
-  reviews: Minors corrected, one Major resolved by the replay, no Blocker; the
-  built-in security review found no exploitable vulnerability and two LOW items
-  left for the maintainer. Record:
+  were stale account state, not the module (the controller names the case-3
+  account anew, `1dec389`). The built-in security review found no exploitable
+  vulnerability and two LOW items left for the maintainer. Record:
   `Tests/Lab/Acceptance-2026-10-10-os-matrix.md`.
 - 2026-10-10: the maintainer integrated the stack. His branch deletion after the
   merge of #116 (`8a6be9f`, 09:10:12Z) removed the base branch of #117, and
@@ -99,9 +96,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of
   the final local candidate. Record:
   `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`.
-- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (local,
-  `ai/coverage-unknowns`; the maintainer pushed `2b97422`, later commits are
-  local). rc7 measured at `fa0701b`: 3,198/3,649 sequence points; the live
+- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (branch
+  `ai/coverage-unknowns`, merged as #125 on 2026-10-19). rc7 measured at
+  `fa0701b`: 3,198/3,649 sequence points; the live
   suite and the suite on a domain member add 9 sequence and 4 explicit branch
   points (`fdd7a8b`); two `tr-TR` defects fixed test-first (`419cfb3`;
   `0028ccd`, `fbe0289`, `8a625c8`); 101 `It` blocks added. The piped
@@ -115,6 +112,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   hard-link names under another root, the silent default scope of an
   unconvertible piped `AppliesTo`. Report:
   `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`.
+- 2026-10-19: #125 (Handoff 5) and #124 merged, CI on `master` green. The
+  maintainer decided the path to stable (Decision 21): Decisions 22 and 24
+  accepted, 23 option 3 with the decision date 2026-11-02 (the #34 follow-up
+  went up at 12:09 UTC), rc8 with the fix of `GetEffectiveAccess`, and a
+  tests-only round for the plain test gaps until 2026-11-02.
 
 ## Stable capabilities
 
@@ -128,8 +130,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 ## Open work
 
 1. Decision 21 gate: the published rc7 is accepted in the matrix and the first
-   lab (record); review Decision 22 and the open items below. Do not release
-   5.0.0 until the remaining-path and OS-matrix gates close. Release steps:
+   lab (record); rc8 needs the same acceptance, and stable follows it
+   (Decision 21, "Closing the gate"). Do not release 5.0.0 until the other
+   gates close. Release steps:
    `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date
    `[5.0.0]`, add the last prerelease to `$publishedVersions` (never the
    version of the manifest), tag through CI.
@@ -143,7 +146,7 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    library-only RemoveAll account filters; rc5 unchecked Authz errors and
    lab-controller hardening; rc6 failed privilege-disable retry (not
    reproduced); rc7 audit missing-path error IDs declined in Decision 22.
-4. Architecture/cmdlet design: Decision 22 remains proposed; two link
+4. Architecture/cmdlet design: Decision 22 is accepted (2026-10-19); two link
    changes are breaking. Keep unused classes/helper overloads until a
    maintainer decision; do not remove them to improve coverage percentages.
 5. ARM64 workstation: out of scope (maintainer, 2026-10-11, Decision 25).
@@ -155,9 +158,8 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    (`Tests/Coverage`): 167 explained from source with evidence, 16 open (8:
    `FileSecurity` conversions, `RemoveAll` account filters; 8 getters of
    pipeline parameters that no test binds by property name). Other open
-   decisions: lazy path overloads, abandoned
-   `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17
-   owner-restore handlers that do not pass on
+   decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns
+   of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on
    what a later command raises (a rare combination), unused classes. No
    trigger for an audit write's ownership retry was found on a local volume or
    a Windows file server (probe of 48 calls) and no test reaches it. A
@@ -167,9 +169,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    artifact SHA-512 verification; the original upload errors remain errors for
    missing, different, or unverifiable outcomes. The agent published nothing,
    so the recovery has never run against the Gallery.
-9. Operating-system matrix (Decision 24, proposed): the lab and the cells exist
-   and the published rc7 passes them (record); the maintainer approves the
-   matrix. #34 has no new reply since 2026-10-06.
+9. Operating-system matrix (Decision 24, accepted 2026-10-19): the lab and the
+   cells exist and the published rc7 passes them (record). #34: the follow-up
+   went up on 2026-10-19, no reply yet; the decision date is 2026-11-02.
 10. Lab rollback evidence: new checkpoints report Standard even after a
     successful temporary ProductionOnly probe; original VM policy restored, no
     checkpoint restored. Don't represent them as verified Production snapshots.

.memory-bank/systemPatterns.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-10
+last-verified: 2026-10-19
 owner: active-agent
 source: repository and regression evidence
 ---
@@ -46,9 +46,9 @@ Read only task-relevant records; the index controls routing.
 | 19 | [Cmdlets write only the sections that they change](decisions/0019-write-only-changed-sections.md) |
 | 20 | [Live tests in a lab live in Tests\Lab](decisions/0020-live-tests-in-tests-lab.md) |
 | 21 | [A quality gate before 5.0.0](decisions/0021-quality-gate-before-5.0.0.md) |
-| 22 | [The behavior changes of Phase 2 (proposed)](decisions/0022-phase-2-behavior-changes.md) |
-| 23 | [Non-Windows file servers before 5.0.0, #34 (proposed)](decisions/0023-non-windows-file-servers.md) |
-| 24 | [The operating-system matrix lab (proposed)](decisions/0024-os-matrix-lab.md) |
+| 22 | [The behavior changes of Phase 2](decisions/0022-phase-2-behavior-changes.md) |
+| 23 | [Non-Windows file servers before 5.0.0, #34 (option 3; gate open)](decisions/0023-non-windows-file-servers.md) |
+| 24 | [The operating-system matrix lab](decisions/0024-os-matrix-lab.md) |
 | 25 | [Four environments are out of scope for the tests](decisions/0025-out-of-scope-environments.md) |
 | 26 | [No default parameter set for Add and Remove (access, audit)](decisions/0026-no-default-parameter-set-add-remove.md) |