docs(memory-bank): record the maintainer's decisions on the path to stable 5.0.0

After the merge of #125 and #124, the maintainer decided on 2026-10-19:

- Decision 21, "Closing the gate": rc8 is mandatory (master is ahead of rc7 by
  the seven product files of #125, and stable is accepted through the last
  prerelease); rc8 carries the fix of the false "no access" of
  Get-NTFSEffectiveAccess, while the hard-link names under a root that is not
  the volume root stay a known limit listed in the release notes; the plain
  test gaps are closed in a tests-only round until 2026-11-02; the steps from
  rc8 to the stable tag.
- Decision 22 accepted: all ten behavior changes of rc7, two of them breaking.
- Decision 23: option 3, a decision date of 2026-11-02; the gate for #34 stays
  open, and no risk is accepted.
- Decision 24 accepted: the operating-system matrix as it is.

The decision index, the active context, and the progress file follow. The
oldest entries of the progress file are shortened to stay under the line
budget.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-11
+last-verified: 2026-10-19
 owner: active-agent
 source: current task evidence
 ---
@@ -9,22 +9,20 @@ source: current task evidence
 
 ## Current focus
 
-State at 2026-10-11 13:50 UTC: Handoff 5 (the coverage unknowns) is done
-locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; the
-maintainer pushed the branch at `2b97422`, and the later commits are local.
-The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` with nine
-CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence points. Three
-defects are fixed test-first: two `tr-TR` comparisons (`419cfb3`; `0028ccd`,
-`fbe0289`, `8a625c8`) and the piped `AppliesTo` that a path dropped (`93ed2c7`,
-`9783d2a`: no default parameter set for Add and Remove of access and audit,
-Decision 26); one defect is open (hard-link names under a root that is not the
-volume root). 101 new `It` blocks; at `2112ee3` (product code built once at
-`9783d2a`): 1,492 cases per configuration, 3,266/3,668 points. The final
-package passed in the labs (first lab 245/0/1 per edition; the suite on the file
-servers and the client, 16 configurations; the three cells 229/0/2 per
-edition), every end state clean. Three independent reviews and two checks read
-the work, with no Blocker. The maintainer decides whether the fixes and the
-tests enter a new candidate.
+State at 2026-10-19 12:30 UTC: Handoff 5 is integrated. The maintainer merged
+pull request #125 (`ai/coverage-unknowns`, `17729d7`) and #124 (Dependabot: the
+pinned `upload-artifact` and `download-artifact` actions, `354ce04`) into
+`master`; CI is green on both. rc7 (`fa0701b`) is still the newest release and
+the manifest still says `rc7`, but `master` is ahead of it by seven product
+files (the culture comparisons of an identity and of `Get-ChildItem2 -Filter`,
+and the piped `AppliesTo`, Decision 26). The stable build is accepted through
+the last prerelease, so rc8 is mandatory. On 2026-10-19 the maintainer decided
+the path to stable (Decision 21, "Closing the gate"): rc8 carries the fix of
+the false "no access" of `Get-NTFSEffectiveAccess`; the hard-link names stay a
+known limit in the release notes; the plain test gaps are closed in a
+tests-only round until 2026-11-02; #34 waits for a tester until 2026-11-02;
+Decisions 22 and 24 are accepted (23: option 3). His #34 follow-up went up on
+2026-10-19 at 12:09 UTC; nobody has replied. Next: the fix and the test round.
 
 State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack
 into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120
@@ -150,43 +148,44 @@ acceptance is the maintainer's.
 
 ## Next step
 
-1. Gate 3 is done for the published rc7 (the record above). A changed binary
-   (rc8, or the build of 5.0.0) needs the same cells again; the release
-   procedure accepts the last prerelease for the stable build (his decision).
+1. Gate 3 is done for the published rc7 (the record above). rc8 needs the same
+   acceptance (the matrix cells, the first lab, the suite on the file servers
+   and the client); the release procedure accepts the last prerelease for the
+   stable build (Decision 21, "Closing the gate").
    Open: keep or replace the matrix VMs (about 60 GB) and the evaluation client
    (it shuts down every hour; `OSWin11E` is off), and a domain cell for Windows
    11 26H1, whose client loses the secure channel to the Server 2025 domain
    controller. A kit script for the whole sequence would make the repetition
    one command (the driver is `Run-Gate3.ps1` in the evidence; not in the kit).
-2. The change that sets the next version (rc8 or 5.0.0) adds `5.0.0-rc7` to
-   `$publishedVersions`; adding it earlier fails the reuse test (deployment
-   notes). Every release step is the maintainer's.
-3. He decides the open items of the paths report: `FileSecurity` conversions,
-   `RemoveAll` account filters, lazy path overloads, abandoned
+2. The rc8 pull request adds `5.0.0-rc7` to `$publishedVersions` (the list ends
+   at rc6; adding it earlier fails the reuse test, deployment notes), and the
+   stable pull request adds `5.0.0-rc8`. Every release step is the
+   maintainer's.
+3. He decides the other open items of the paths report: `FileSecurity`
+   conversions, `RemoveAll` account filters, lazy path overloads, abandoned
    `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, the 17
    owner-restore handlers without the later-command check, unused classes
-   (Decisions 21/22). He also confirms or changes the proposed Decisions 22 and
-   24.
-4. #34 stays open (Decision 23; no reply since 2026-10-06): the maintainer
-   chooses between waiting for a test of the published candidate on the
-   NetApp, EMC, and IBM ESS servers of the reporters (checklist:
-   `Tests/Lab/Non-Windows-File-Server-Test.md`) and accepting the untested
-   risk with a release-note caveat. No agent can accept it.
-5. He decides the two LOW findings of the security review (record, Limits):
-   the swallowed initialization errors of `GetEffectiveAccess` (a false "no
-   access" instead of an error on an OS that refuses at initialization; fix:
-   record the exceptions in `authzException`, with a regression test and a
-   check of "the error stays" in the help and CHANGELOG), and the ACL of the
-   stage folders under `C:\` in the lab kit (they inherit Authenticated Users:
+   (Decisions 21/22). Decisions 22 and 24 are accepted (2026-10-19).
+4. #34 waits for a tester until 2026-11-02 (Decision 23, option 3; the
+   follow-up went up on 2026-10-19, no reply yet; checklist:
+   `Tests/Lab/Non-Windows-File-Server-Test.md`). On that date the maintainer
+   chooses between waiting longer and accepting the untested risk with a
+   release-note caveat. No agent can accept it.
+5. Of the two LOW findings of the security review (record, Limits), the
+   swallowed initialization errors of `GetEffectiveAccess` (a false "no
+   access" instead of an error on an OS that refuses at initialization) are
+   fixed in rc8 (decided 2026-10-19): record the exceptions in
+   `authzException`, with a regression test and a check of "the error stays" in
+   the help and CHANGELOG. He still decides the other: the ACL of the stage
+   folders under `C:\` in the lab kit (they inherit Authenticated Users:
    Modify; protecting them is a design change of the controller and needs a new
    acceptance). The help could also say that a local standard user who asks
    about a domain account still gets "Access is denied".
-6. Handoff 5 is done (Evidence). The maintainer decides whether the fixes
-   (`419cfb3`, `0028ccd`, `fbe0289`, `8a625c8`, `93ed2c7`, `9783d2a`) and the
-   tests enter a new candidate (rc8), which needs the matrix cells and the
-   first lab on its own bytes, and he decides the open items of the report:
-   hard-link names under another root (a defect with a reproduction), the
-   silent default scope for a piped `AppliesTo` that PowerShell cannot convert
-   (a design change), 8 getters of pipeline parameters, the 51 partly closed
-   sets, and the audit paths.
+6. Handoff 5 is done and merged (Evidence). Decided on 2026-10-19 (Decision
+   21): the hard-link names under another root (a defect with a reproduction)
+   stay a known limit that the release notes list; the plain test items (68
+   `budget` mentions in the 57 sets that are not closed) are closed in a
+   tests-only round until 2026-11-02. Still his: the silent default scope for a
+   piped `AppliesTo` that PowerShell cannot convert (a design change), the 8
+   getters of pipeline parameters, and the audit paths.
 7. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/decisions/0021-quality-gate-before-5.0.0.md

@@ -1,9 +1,9 @@
 ---
 status: accepted
 date: 2026-10-08
-last-verified: 2026-10-08
+last-verified: 2026-10-19
 owner: shared
-source: maintainer decision of 2026-10-08
+source: maintainer decision of 2026-10-08; closing choices of 2026-10-19
 ---
 
 # Decision 21: A quality gate before 5.0.0
@@ -35,3 +35,37 @@ source: maintainer decision of 2026-10-08
   (Decision 16); so do the 244 lines of classes that no cmdlet calls, the
   operating systems of Phase 3, and how to cover file servers that aren't
   Windows (#34).
+
+## Closing the gate (maintainer, 2026-10-19)
+
+After Handoff 5 and the merges of #125 and #124 (`master` at `354ce04`), the
+maintainer answered five questions, each time with the recommended option:
+
+- rc8 is the next prerelease and carries `master`, which is ahead of rc7 by the
+  seven product files of #125. Stable 5.0.0 is accepted through the last
+  prerelease (`Docs/Contributing/05-Releasing.md`), so rc8 is mandatory.
+- Code before rc8: fix the false "no access" of `Get-NTFSEffectiveAccess` (the
+  swallowed initialization errors, a LOW finding of the security review),
+  test-first, with an independent review. The hard-link names under a root that
+  is not the volume root stay a known limit that the release notes list (the
+  exit criterion allows "fixed, or accepted and listed"). The other open items
+  of the paths report and of Handoff 5 are not decided yet.
+- Test gaps: the plain test items that the ParameterSets table marks `budget`
+  (68 mentions in the 57 sets that are not closed) are closed in a round of
+  tests only, time-boxed to 2026-11-02; the report lists what is left. The
+  shipped DLL does not change by it. A defect that a test finds needs its own
+  decision and a new prerelease.
+- #34: wait for a tester until 2026-11-02, then choose between waiting longer
+  and accepting the untested risk (Decision 23, option 3).
+- Decisions 22 and 24 are accepted (their records).
+- A tester's result on rc7 counts for rc8 only while no change of rc8 touches
+  the code that writes a section of a security descriptor (Decision 19). The
+  seven product files of #125 have no such line, and the fix of
+  `Get-NTFSEffectiveAccess` reads.
+- Path to stable: the rc8 pull request (label `rc8`, `5.0.0-rc7` into
+  `$publishedVersions`, changelog), the tag, the acceptance of the published
+  rc8 (matrix cells, first lab, suite on the four machines), the stable pull
+  request (no `Prerelease`, `## [5.0.0] - <date>`, `5.0.0-rc8` into
+  `$publishedVersions`), the tag. The maintainer checks the expiry of
+  `PSGALLERY_API_KEY` before the stable tag. After 5.0.0 the repository is
+  archived (Decision 18), so what ships stays.

.memory-bank/decisions/0022-phase-2-behavior-changes.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-08
-last-verified: 2026-10-09
+last-verified: 2026-10-19
 owner: shared
-source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09
+source: agent choices in autopilot on 2026-10-08, for the maintainer's review; confirmed by the agent under his delegation on 2026-10-09; accepted by the maintainer on 2026-10-19
 ---
 
 # Decision 22: The behavior changes of Phase 2
@@ -51,8 +51,7 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c
   (3); the conventions of .NET and PowerShell (4, 9); no implicit creation
   of folders (10; `Copy-Item` creates them for a folder, see the correction
   below).
-- Open: the maintainer accepts or reverts each choice; then this record
-  becomes `accepted`.
+- Accepted by the maintainer on 2026-10-19 (see the end of this record).
 
 ## Confirmed under delegation, 2026-10-09
 
@@ -104,4 +103,8 @@ source: agent choices in autopilot on 2026-10-08, for the maintainer's review; c
   the help from `Docs`, adjust the changelog and the cmdlet page, and run
   the four test configurations again; a later commit on the same page or
   test can conflict.
-- Open: the maintainer confirms (`accepted`) or reverts each item.
+- Accepted: on 2026-10-19 the maintainer answered "Confirm all ten" to the
+  question about these ten choices, which listed the ten and marked 7 and 8 as
+  breaking. The confirmation of 2026-10-09 under his delegation is superseded.
+  After 5.0.0 the changes are permanent, because the repository is archived
+  (Decision 18).

.memory-bank/decisions/0023-non-windows-file-servers.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-09
-last-verified: 2026-10-09
+last-verified: 2026-10-19
 owner: shared
-source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC
+source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-10-09 21:33 UTC; option 3 chosen by the maintainer on 2026-10-19
 ---
 
 # Decision 23: Non-Windows file servers before 5.0.0 (#34)
@@ -58,8 +58,16 @@ source: agent assessment for the maintainer (Handoff 4), from #34 read on 2026-1
   was tested on Windows file servers. NetApp, EMC, and IBM ESS file servers
   weren't available for 5.0.0. If a command still fails there with error
   1307, tell us in #34. `icacls` is the fallback."
-- Open: the maintainer's choice between the options, and the date. Until
-  then the gate of Decision 21 for #34 is open.
+- Chosen (maintainer, 2026-10-19): option 3, with the decision date
+  2026-11-02, 14 days after the follow-up. He posted a follow-up on #34 on
+  2026-10-19 at 12:09 UTC, adapted from the draft below: it asks for the newest
+  prerelease (then rc7), links the checklist on `master`, and names no date. A
+  tester's result on rc7 counts for rc8 while no change of rc8 touches the
+  code that writes a section (Decision 21, "Closing the gate"). The gate of
+  Decision 21 for #34 stays open: no tester has reported, and no risk is
+  accepted. On 2026-11-02 the maintainer chooses between waiting longer
+  (option 1) and accepting the untested risk with the caveat below (option 2).
+  No answer keeps the gate open.
 - Tester checklist: `Tests/Lab/Non-Windows-File-Server-Test.md`. It uses a
   new folder that the tester controls and asks for sanitized evidence.
 - Draft comment for #34 (for the maintainer to post; the agent posts

.memory-bank/decisions/0024-os-matrix-lab.md

@@ -1,9 +1,9 @@
 ---
-status: proposed
+status: accepted
 date: 2026-10-09
-last-verified: 2026-10-10
+last-verified: 2026-10-19
 owner: shared
-source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3
+source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff 2); the scope follows Decision 21, phase 3; confirmed by the maintainer on 2026-10-19
 ---
 
 # Decision 24: The operating-system matrix lab
@@ -141,12 +141,13 @@ source: agent decisions under the maintainer's delegation of 2026-10-09 (Handoff
   counts: the three cells (1,374 passed, 0 failed, 12 skipped), the suite in 24
   runs, and the first lab with case 9 (245 / 0 / 1 per edition); see
   [its record](../../Tests/Lab/Acceptance-2026-10-10-published-rc7.md).
-- Open: the maintainer confirms or changes the matrix and decides whether to
-  keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the release
-  procedure accepts the last prerelease; a changed binary needs the same cells
-  again. The newest Windows 11 build that can join a Server 2025 domain here is
-  22H2; a domain cell with 26H1 needs a newer domain controller build or a fix
-  of the mismatch. All three module fixes went into rc7 (#119; `962887a` holds
-  two, `fdd7a8b` one, and they don't revert separately). The maintainer also
-  decides whether the evaluation client stays (it needs a start shortly before
-  every run) or is replaced by a client with a license that doesn't expire.
+- Accepted: the maintainer confirmed the matrix as it is on 2026-10-19. Open:
+  whether to keep the VMs after 5.0.0. A stable 5.0.0 is a new build, so the
+  release procedure accepts the last prerelease; a changed binary needs the
+  same cells again. The newest Windows 11 build that can join a Server 2025
+  domain here is 22H2; a domain cell with 26H1 needs a newer domain controller
+  build or a fix of the mismatch. All three module fixes went into rc7 (#119;
+  `962887a` holds two, `fdd7a8b` one, and they don't revert separately). The
+  maintainer also decides whether the evaluation client stays (it needs a start
+  shortly before every run) or is replaced by a client with a license that
+  doesn't expire.

.memory-bank/progress.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-11
+last-verified: 2026-10-19
 owner: active-agent
 source: repository and validation evidence
 ---
@@ -14,9 +14,11 @@ source: repository and validation evidence
 whole stack into `master` (CI green): #116 (rc7), #120 (it replaced
 #117, which GitHub closed unmerged when the branch deletion after #116 removed
 its base), #118 (the quality-gate paths), #119 (the operating-system matrix
-with three module fixes, Decision 24 proposed), and #121 (the Memory Bank). The
+with three module fixes, Decision 24), and #121 (the Memory Bank). The
 published rc7 passed its lab acceptance (gate 3) in the matrix and in the first
-lab. Stable Gallery version: 4.2.6.
+lab. On 2026-10-19 he merged #125 (Handoff 5) and #124 (Dependabot), and decided
+the path to stable (Decision 21, "Closing the gate"). Stable Gallery version:
+4.2.6.
 After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 
 ## Recent milestones
@@ -48,14 +50,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 - 2026-10-09: release attempt 2 succeeded; rc6 GitHub prerelease and zip
   appeared at 07:01:34 UTC. #116 passed CI on `d25647d`.
 - 2026-10-09: autonomous follow-up on `ai/quality-gate-coverage` (#117, then
-  #120), through `3442194`: 202 cases above rc7 (deletion/owner failures, all
-  13 scopes, inheritance transitions, enumeration, forced replacement,
-  descriptor failures, offline CI recovery); fixed rooted result paths and the
-  first-hidden-item omission; publication recovery verifies the exact SHA-512
-  identity, not merely the version. Suite: 914 per configuration, zero
+  #120), through `3442194`: 202 cases above rc7; fixed rooted result paths and
+  the first-hidden-item omission; publication recovery verifies the exact
+  SHA-512 identity, not merely the version. Suite: 914 per configuration, zero
   failures; 2,641/3,559 sequence points (74.21%), 974/1,933 branches (50.39%).
-  Live comparison, 09:20 to 09:51 UTC: candidate 330 passed, 0 failed, 2
-  expected skips; published rc6 only its four expected failures (`7594e0c`).
+  Live comparison: candidate 330 passed, 0 failed, 2 expected skips (`7594e0c`).
 - 2026-10-09: handoff 1 (#118): suite 914 to 1,310 per configuration, zero
   failures; 3,192/3,634 sequence points (87.84%), 1,273/1,978 branches; all 231
   unvisited methods classified (223 explained, 8 open). Eleven defects fixed,
@@ -75,11 +74,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   suite on every machine (24 runs), the live controller in three cells (1,374
   passed, 0 failed, 12 skipped), and the first lab with case 9 (245 passed, 0
   failed, 1 skipped per edition). The Server 2022 effective-access failures
-  were stale account state, not the module (a replay; the Windows mechanism is
-  unknown); the controller names the case-3 account anew (`1dec389`). Built-in
-  reviews: Minors corrected, one Major resolved by the replay, no Blocker; the
-  built-in security review found no exploitable vulnerability and two LOW items
-  left for the maintainer. Record:
+  were stale account state, not the module (the controller names the case-3
+  account anew, `1dec389`). The built-in security review found no exploitable
+  vulnerability and two LOW items left for the maintainer. Record:
   `Tests/Lab/Acceptance-2026-10-10-os-matrix.md`.
 - 2026-10-10: the maintainer integrated the stack. His branch deletion after the
   merge of #116 (`8a6be9f`, 09:10:12Z) removed the base branch of #117, and
@@ -99,9 +96,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of
   the final local candidate. Record:
   `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`.
-- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (local,
-  `ai/coverage-unknowns`; the maintainer pushed `2b97422`, later commits are
-  local). rc7 measured at `fa0701b`: 3,198/3,649 sequence points; the live
+- 2026-10-10 to 2026-10-11: Handoff 5, the coverage unknowns (branch
+  `ai/coverage-unknowns`, merged as #125 on 2026-10-19). rc7 measured at
+  `fa0701b`: 3,198/3,649 sequence points; the live
   suite and the suite on a domain member add 9 sequence and 4 explicit branch
   points (`fdd7a8b`); two `tr-TR` defects fixed test-first (`419cfb3`;
   `0028ccd`, `fbe0289`, `8a625c8`); 101 `It` blocks added. The piped
@@ -115,6 +112,11 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   hard-link names under another root, the silent default scope of an
   unconvertible piped `AppliesTo`. Report:
   `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`.
+- 2026-10-19: #125 (Handoff 5) and #124 merged, CI on `master` green. The
+  maintainer decided the path to stable (Decision 21): Decisions 22 and 24
+  accepted, 23 option 3 with the decision date 2026-11-02 (the #34 follow-up
+  went up at 12:09 UTC), rc8 with the fix of `GetEffectiveAccess`, and a
+  tests-only round for the plain test gaps until 2026-11-02.
 
 ## Stable capabilities
 
@@ -128,8 +130,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 ## Open work
 
 1. Decision 21 gate: the published rc7 is accepted in the matrix and the first
-   lab (record); review Decision 22 and the open items below. Do not release
-   5.0.0 until the remaining-path and OS-matrix gates close. Release steps:
+   lab (record); rc8 needs the same acceptance, and stable follows it
+   (Decision 21, "Closing the gate"). Do not release 5.0.0 until the other
+   gates close. Release steps:
    `Docs/Contributing/05-Releasing.md`; remove the prerelease label, date
    `[5.0.0]`, add the last prerelease to `$publishedVersions` (never the
    version of the manifest), tag through CI.
@@ -143,7 +146,7 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    library-only RemoveAll account filters; rc5 unchecked Authz errors and
    lab-controller hardening; rc6 failed privilege-disable retry (not
    reproduced); rc7 audit missing-path error IDs declined in Decision 22.
-4. Architecture/cmdlet design: Decision 22 remains proposed; two link
+4. Architecture/cmdlet design: Decision 22 is accepted (2026-10-19); two link
    changes are breaking. Keep unused classes/helper overloads until a
    maintainer decision; do not remove them to improve coverage percentages.
 5. ARM64 workstation: out of scope (maintainer, 2026-10-11, Decision 25).
@@ -155,9 +158,8 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    (`Tests/Coverage`): 167 explained from source with evidence, 16 open (8:
    `FileSecurity` conversions, `RemoveAll` account filters; 8 getters of
    pipeline parameters that no test binds by property name). Other open
-   decisions: lazy path overloads, abandoned
-   `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17
-   owner-restore handlers that do not pass on
+   decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns
+   of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on
    what a later command raises (a rare combination), unused classes. No
    trigger for an audit write's ownership retry was found on a local volume or
    a Windows file server (probe of 48 calls) and no test reaches it. A
@@ -167,9 +169,9 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    artifact SHA-512 verification; the original upload errors remain errors for
    missing, different, or unverifiable outcomes. The agent published nothing,
    so the recovery has never run against the Gallery.
-9. Operating-system matrix (Decision 24, proposed): the lab and the cells exist
-   and the published rc7 passes them (record); the maintainer approves the
-   matrix. #34 has no new reply since 2026-10-06.
+9. Operating-system matrix (Decision 24, accepted 2026-10-19): the lab and the
+   cells exist and the published rc7 passes them (record). #34: the follow-up
+   went up on 2026-10-19, no reply yet; the decision date is 2026-11-02.
 10. Lab rollback evidence: new checkpoints report Standard even after a
     successful temporary ProductionOnly probe; original VM policy restored, no
     checkpoint restored. Don't represent them as verified Production snapshots.

.memory-bank/systemPatterns.md

@@ -1,6 +1,6 @@
 ---
 status: current
-last-verified: 2026-10-10
+last-verified: 2026-10-19
 owner: active-agent
 source: repository and regression evidence
 ---
@@ -46,9 +46,9 @@ Read only task-relevant records; the index controls routing.
 | 19 | [Cmdlets write only the sections that they change](decisions/0019-write-only-changed-sections.md) |
 | 20 | [Live tests in a lab live in Tests\Lab](decisions/0020-live-tests-in-tests-lab.md) |
 | 21 | [A quality gate before 5.0.0](decisions/0021-quality-gate-before-5.0.0.md) |
-| 22 | [The behavior changes of Phase 2 (proposed)](decisions/0022-phase-2-behavior-changes.md) |
-| 23 | [Non-Windows file servers before 5.0.0, #34 (proposed)](decisions/0023-non-windows-file-servers.md) |
-| 24 | [The operating-system matrix lab (proposed)](decisions/0024-os-matrix-lab.md) |
+| 22 | [The behavior changes of Phase 2](decisions/0022-phase-2-behavior-changes.md) |
+| 23 | [Non-Windows file servers before 5.0.0, #34 (option 3; gate open)](decisions/0023-non-windows-file-servers.md) |
+| 24 | [The operating-system matrix lab](decisions/0024-os-matrix-lab.md) |
 | 25 | [Four environments are out of scope for the tests](decisions/0025-out-of-scope-environments.md) |
 | 26 | [No default parameter set for Add and Remove (access, audit)](decisions/0026-no-default-parameter-set-add-remove.md) |