diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv
new file mode 100644
index 0000000..995c9a8
--- /dev/null
+++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-Cells.csv
@@ -0,0 +1,25 @@
+"Run","Candidate","FileServer","FileServerOs","Client","ClientOs","Edition","Role","Account","ExitCode","Passed","Failed","Skipped"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 10.0.17763.1217 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 10.0.20348.4773 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Desktop","Server","osmatrix\install","0","73","0","1"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Delegate","osmatrix\NtfsLiveDelegate","0","69","0","0"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","ServerAdmin","osmatrix\NtfsLiveServerAdmin","0","36","0","0"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Admin","osmatrix\NtfsLiveAdmin","0","51","0","1"
+"rc8","5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 10.0.26100.32690 (server)","OSWin11E","Windows 11 Enterprise Evaluation 10.0.22621.525 (client)","Core","Server","osmatrix\install","0","73","0","1"
diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv
new file mode 100644
index 0000000..eafa145
--- /dev/null
+++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-FirstLab.csv
@@ -0,0 +1,9 @@
+"Version","Edition","Role","Account","ExitCode","Passed","Failed","Skipped"
+"5.0.0-rc8","Desktop","Delegate","A\NtfsLiveDelegate","0","69","0","0"
+"5.0.0-rc8","Desktop","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0"
+"5.0.0-rc8","Desktop","Admin","A\NtfsLiveAdmin","0","64","0","0"
+"5.0.0-rc8","Desktop","Server","A\install","0","76","0","1"
+"5.0.0-rc8","Core","Delegate","A\NtfsLiveDelegate","0","69","0","0"
+"5.0.0-rc8","Core","ServerAdmin","A\NtfsLiveServerAdmin","0","36","0","0"
+"5.0.0-rc8","Core","Admin","A\NtfsLiveAdmin","0","64","0","0"
+"5.0.0-rc8","Core","Server","A\install","0","76","0","1"
diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv
new file mode 100644
index 0000000..0727ffa
--- /dev/null
+++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-LocalSuite.csv
@@ -0,0 +1,25 @@
+"Candidate","Machine","Os","Mode","Edition","PowerShell","Result","Passed","Failed","Skipped","Total","Seconds"
+"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Core","7.6.3","Passed","905","0","286","1191","144"
+"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Basic","Desktop","5.1.17763.1007","Passed","907","0","284","1191","175"
+"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Core","7.6.3","Passed","1170","0","21","1191","214"
+"5.0.0-rc8","OSFile19","Windows Server 2019 Datacenter 17763.1217","Elevated","Desktop","5.1.17763.1007","Passed","1172","0","19","1191","110"
+"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Core","7.6.3","Passed","905","0","286","1191","167"
+"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Basic","Desktop","5.1.20348.4294","Passed","907","0","284","1191","181"
+"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Core","7.6.3","Passed","1170","0","21","1191","236"
+"5.0.0-rc8","OSFile22","Windows Server 2022 Datacenter 20348.4773","Elevated","Desktop","5.1.20348.4294","Passed","1172","0","19","1191","124"
+"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Core","7.6.3","Passed","905","0","286","1191","109"
+"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Basic","Desktop","5.1.26100.32684","Passed","907","0","284","1191","152"
+"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Core","7.6.3","Passed","1170","0","21","1191","222"
+"5.0.0-rc8","OSFile25","Windows Server 2025 Datacenter 26100.32690","Elevated","Desktop","5.1.26100.32684","Passed","1172","0","19","1191","262"
+"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Core","7.6.3","Passed","905","0","286","1191","34"
+"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Basic","Desktop","5.1.22621.169","Passed","907","0","284","1191","191"
+"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Core","7.6.3","Passed","1170","0","21","1191","109"
+"5.0.0-rc8","OSWin11E","Windows 10 Enterprise Evaluation 22621.525","Elevated","Desktop","5.1.22621.169","Passed","1172","0","19","1191","130"
+"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Basic","Core","7.6.3","Passed","905","0","286","1191","36"
+"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Basic","Desktop","5.1.28000.1830","Passed","907","0","284","1191","173"
+"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Elevated","Core","7.6.3","Passed","1170","0","21","1191","103"
+"5.0.0-rc8","OSWin11","Windows 10 Pro 28000.1836","Elevated","Desktop","5.1.28000.1830","Passed","1172","0","19","1191","171"
+"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Basic","Core","7.6.7","Passed","904","0","286","1190","21"
+"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Basic","Desktop","5.1.26100.33648","Passed","906","0","284","1190","23"
+"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Elevated","Core","7.6.7","Passed","1169","0","21","1190","92"
+"5.0.0-rc8","LOCAL","Windows Server 2025 Datacenter 26100.33650","Elevated","Desktop","5.1.26100.33648","Passed","1171","0","19","1190","111"
diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv b/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv
new file mode 100644
index 0000000..8e1f6e0
--- /dev/null
+++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8-ModuleFiles.csv
@@ -0,0 +1,12 @@
+"File","ZipSha256","NupkgSha256","Equal"
+"AlphaFS.dll","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","A8DA47194AB0F71232C69D01955AD93BA73C7ECEB58D0DE800CA085D4A2E18D8","True"
+"NTFSSecurity.dll","D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79","D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79","True"
+"NTFSSecurity.format.ps1xml","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","FB0920CC37ED858F55AFD54998DC854E27FBBE6A0177CB059CB03CFE91361197","True"
+"NTFSSecurity.Init.ps1","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","59583423241951EBE0FC2D8237D0C28C3ECC8C7CD2C115D2660F8579888632FC","True"
+"NTFSSecurity.psd1","5830FFD90D50F1120CE698A9F276CA4D8E1DD05284ECAFB4AA0094E8BD98E015","5830FFD90D50F1120CE698A9F276CA4D8E1DD05284ECAFB4AA0094E8BD98E015","True"
+"NTFSSecurity.psm1","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","3F777E9D141EE0046119DA9D5ECF88A3BC7E023726098FE2FB150528E2FB59B8","True"
+"NTFSSecurity.types.ps1xml","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","CB6882FF91E6716605D5599E7B464C3346E461216ACED07E847621738F04FB9B","True"
+"PrivilegeControl.dll","F789CC92F763EAD2C77EA72E136CB19DFBF41EC0116842270207B44312DC7236","F789CC92F763EAD2C77EA72E136CB19DFBF41EC0116842270207B44312DC7236","True"
+"ProcessPrivileges.dll","1A7EFE3189B0BFEFEF86B0E8DF91551BAD1AC9DBF611ECC1019EF77C3FF8798B","1A7EFE3189B0BFEFEF86B0E8DF91551BAD1AC9DBF611ECC1019EF77C3FF8798B","True"
+"Security2.dll","8ED7F6FFD8ABF14DE0EDED3AFB64FD0AB8273D7DDE48F62D6F860CF7B8BA9BEC","8ED7F6FFD8ABF14DE0EDED3AFB64FD0AB8273D7DDE48F62D6F860CF7B8BA9BEC","True"
+"en-US\NTFSSecurity.dll-Help.xml","F8F2BD9FA913437E2F745D7DFE8A3B995C59178A9E956D28E1568357ACF8CE76","F8F2BD9FA913437E2F745D7DFE8A3B995C59178A9E956D28E1568357ACF8CE76","True"
diff --git a/Tests/Lab/Acceptance-2026-10-20-published-rc8.md b/Tests/Lab/Acceptance-2026-10-20-published-rc8.md
new file mode 100644
index 0000000..8a940f1
--- /dev/null
+++ b/Tests/Lab/Acceptance-2026-10-20-published-rc8.md
@@ -0,0 +1,286 @@
+# Acceptance of the published 5.0.0-rc8, 2026-10-20
+
+Live and local acceptance of the exact prerelease that the PowerShell Gallery
+has, in the operating-system matrix and in the first lab. It repeats the
+[acceptance of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md)
+with the bytes of rc8, which carries the module changes of the coverage work
+since rc7 and the fix of the swallowed initialization errors of
+`Get-NTFSEffectiveAccess`. This record doesn't repeat the machines, the
+defects, or the method of the earlier records; it adds what differs. It isn't a
+claim that the quality gate is complete (see the limits at the end).
+
+## Result
+
+- The published 5.0.0-rc8 passed every stage. The identity check (tag, CI run,
+  Gallery hash, GitHub zip) passed before the runs. The live controller passed
+  in the three cells of the matrix, both editions, every role: 1,374 passed, 0
+  failed, 12 skipped, and the independent end-state check of every cell said
+  CLEAN. The module's own suite passed in all 24 runs (six machine classes, two
+  editions, elevated and as a basic user), and every skipped test is also
+  skipped on the host. The live controller passed in the first lab, where case 9
+  runs: 245 passed, 0 failed, 1 skipped in each edition, and the independent
+  checks found both labs clean after the run and again at the end.
+- The live counts equal those of the published rc7: 1,374 / 0 / 12 in the cells
+  and 245 / 0 / 1 per edition in the first lab. The live tests and the
+  controller are the same Git blobs as in that run, so the cells measure the
+  changed module, not changed tests. The module's suite has 1,191 cases per
+  configuration on the machines of the domain (rc7: 1,011), because the
+  coverage work added tests.
+- The changes of the module since rc7 are listed below. The unit suites on six
+  machine classes ran their tests; the live tests of
+  `Get-NTFSEffectiveAccess -ServerName` (a computer that can't be reached, and
+  a computer that refuses the user) passed unchanged in every cell.
+- On Windows Server 2019, 2022, and 2025 and on Windows 11 26H1, a computer name
+  of 32,718 characters or more fails with error 14 and a shorter one with error
+  1722, the boundary that the CHANGELOG names for the new
+  `GetEffectiveAccessError` (see "The long name of -ServerName").
+- The run changed nothing in the module, the tests, or the kit: it used the
+  files of the tag.
+
+## What differs from the published rc7
+
+The tag has 36 commits without merges after `5.0.0-rc7`, most of them tests and
+documents. The module changed in nine C# files and in the manifest:
+
+| Change | Files | Commits |
+| --- | --- | --- |
+| The `AppliesTo` property of a piped object binds for a path, and the scope of one piped object no longer reaches the next | `AddAccess.cs`, `RemoveAccess.cs`, `AddAudit.cs`, `RemoveAudit.cs` | `93ed2c7`, `9783d2a` |
+| `Get-ChildItem2` enumerates and filters without the culture of the thread (the filter missed files under `tr-TR`) | `GetChildItem2.cs` | `0028ccd`, `fbe0289`, `8a625c8` |
+| An identity compares with a name without the culture of the thread | `IdentityReference2.cs` | `419cfb3` |
+| `Get-NTFSEffectiveAccess` writes a `GetEffectiveAccessError` when Windows refuses to start the authorization manager, and warns that the result is based on this computer only when it calculated one | `GetEffectiveAccess.cs`, `Lib.cs` | `25fe775` |
+| The prerelease label | `NTFSSecurity.psd1` | `e2e9324` |
+
+No changed line writes or selects a section (owner, group, DACL, or SACL) of a
+security descriptor: the first three rows change how a parameter or a name is
+read, and the fourth changes only the read of the effective access.
+
+## Candidate and artifact identity
+
+`Test-PublishedRelease.ps1 -Version 5.0.0-rc8` ran at 10:42 UTC, before the
+runs, and printed `PUBLISHED_IDENTITY_VERIFIED`. It changes nothing on GitHub or
+in the Gallery.
+
+| | Published 5.0.0-rc8 |
+| --- | --- |
+| Tag | `5.0.0-rc8`, commit `c71919700c3fc48ac910f86f94f59ab2f5731add`, on `master` (the merge of #127) |
+| CI run of the tag | `39408140862` (started 10:28:05 UTC): Build and test and Release succeeded |
+| PowerShell Gallery | published 10:40:58 UTC; the SHA-512 that the Gallery publishes matches the downloaded package |
+| GitHub prerelease | published 10:41:07 UTC |
+| `NTFSSecurity.5.0.0-rc8.nupkg` SHA-256 | `EA90E16F2152016E97BFB3D2413D29F8944704E9D4FBD5101D0A263841BC0510` |
+| `NTFSSecurity.zip` SHA-256 | `288152E20F8CFB1B029BAC055345339970C65BD57C8BA814C2616C32D9F812BC` |
+| `NTFSSecurity.dll` SHA-256 | `D8CB4015BF25379C77A645F82EEECA54F86219F228A5029E32E4D52FBD016E79` |
+| Manifest | `5.0.0` with `Prerelease = 'rc8'` |
+
+The 11 module files of the nupkg and of the zip are byte for byte equal
+([the hashes](Acceptance-2026-10-20-published-rc8-ModuleFiles.csv)). The
+controller checks the SHA-512 that the Gallery publishes before it runs a
+package, and it kept the package that it downloaded in each of its five runs
+(the three cells and the two editions of the first lab): all five nupkg files
+and all five DLLs equal the values above. The suites staged the extracted zip,
+and their logs record the same DLL hash on all six machine classes. The build
+isn't byte-reproducible, so these hashes belong to this one build.
+
+## Method
+
+The method of the records of the matrix and of the published rc7 applies. What
+differs:
+
+- **Frozen kit.** The kit, the controller, and the live tests are the files of
+  the tag, in an isolated worktree, so that no change of the working tree could
+  affect a run in progress. The live tests are the Git blob
+  `efe36e5073b9b10742ca7de242ddcbe90d8eda62` and the controller the blob
+  `635bf162421b4df4efc76d5677212e8782e8bf77`, the same as in the acceptance of
+  the published rc7.
+- **Machines from the saved state.** Every machine of both labs had been saved
+  since 2026-10-11 14:17 UTC. A script restored them in waves (the domain
+  controllers first, then the other domain controllers and the certification
+  authority, then the file servers and clients), and the readiness check of both
+  labs passed at its first attempt (10:43 UTC, clock skew 4 to 5 seconds). The
+  evaluation client `OSWin11E` started at 10:43:41 UTC, because it shuts itself
+  down an hour after each start. After the run, the machines were saved again,
+  as they were found.
+- **Order.** One detached driver ran the stages in this order: the identity
+  check, the readiness of both labs, the three cells of the matrix, the module's
+  suite on six machine classes, the check of what the suites left in the matrix
+  lab, and the first lab. The driver only calls the scripts of the kit and a few
+  helper scripts (see the evidence).
+- **Live controller.** `Run-MatrixSequence.ps1 -Version 5.0.0-rc8 -FileServer
+  OSFile19,OSFile22,OSFile25`, with the client `OSWin11E`: the readiness of
+  every machine, the controller in both editions, `Validate-LabResults.ps1` for
+  every role from the result files (`-Expect Candidate`), a snapshot of the
+  fixture SIDs, `-RemoveFixture`, and `Test-MatrixCleanup.ps1`. In the first lab
+  the same stages ran with the foreign domain controllers of case 9, with
+  `-Version` for each edition in its own run.
+- **Suite.** `Run-MatrixLocalSuite.ps1 -ModulePath` with the extracted zip,
+  `-Mode Elevated,Basic`, both editions, on OSWin11E, OSFile19, OSFile22,
+  OSFile25, OSWin11 (with the local installation account), and the host as the
+  reference. The processes started 75 seconds apart, because AutomatedLab
+  imports one lab at a time.
+- **No checkpoint.** The procedure in the README takes a checkpoint of the
+  machines before a run. This run took none: the machines were restored from
+  their saved state, and the end state of every cell was verified instead.
+
+## Results
+
+### Live controller in the matrix
+
+The Windows 11 client `OSWin11E` with each file server, one sequence (`rc8`),
+10:47 to 11:08 UTC. Every role was checked from the result files, and
+`Validate-LabResults.ps1` printed `LIVE_RESULT_VERIFIED (Candidate)` for each
+cell. The counts are the same in both editions and in all three cells
+([Cells.csv](Acceptance-2026-10-20-published-rc8-Cells.csv)):
+
+| Role | Passed / failed / skipped |
+| --- | --- |
+| Delegate | 69 / 0 / 0 |
+| ServerAdmin | 36 / 0 / 0 |
+| Admin | 51 / 0 / 1 |
+| Server | 73 / 0 / 1 |
+
+That is 229 passed, 0 failed, and 2 skipped per edition and cell, and 1,374
+passed, 0 failed, 12 skipped for the three cells. The skipped tests are those
+of the earlier records: case 9 (the matrix lab has no foreign domain) and the
+test of the module version in the Server role (that role runs without the
+module).
+
+| File server | Cell | Controller | End-state check |
+| --- | --- | --- | --- |
+| OSFile19 (Windows Server 2019) | 10:47:42 to 10:53:53 | 10:48:10 to 10:52:54 | CLEAN |
+| OSFile22 (Windows Server 2022) | 10:53:53 to 10:59:45 | 10:54:16 to 10:58:54 | CLEAN |
+| OSFile25 (Windows Server 2025) | 10:59:45 to 11:08:42 | 11:00:08 to 11:07:51 | CLEAN |
+
+### First lab (case 9)
+
+`WindowsAccessControlLab`, both editions, 11:26 to 11:46 UTC: the domain
+controller `F1ADC1`, the file server `F1AFile2`, and the client `F1AFile1`
+(domain `a.forest1.net`), with the foreign domain controllers `F1BDC1`,
+`F2DC1`, and `F3DC1`. `Validate-LabResults.ps1` printed
+`LIVE_RESULT_VERIFIED (Candidate)` for each edition. The counts are the same in
+both editions
+([FirstLab.csv](Acceptance-2026-10-20-published-rc8-FirstLab.csv)):
+
+| Role | Passed / failed / skipped |
+| --- | --- |
+| Delegate | 69 / 0 / 0 |
+| ServerAdmin | 36 / 0 / 0 |
+| Admin | 64 / 0 / 0 |
+| Server | 76 / 0 / 1 |
+
+That is 245 passed, 0 failed, and 1 skipped per edition; the skipped test is
+the test of the module version in the Server role. The Windows PowerShell run
+took 11:27 to 11:36 UTC and the PowerShell 7 run 11:36 to 11:44 UTC. The
+fixture was removed with `-RemoveFixture`, and the independent check found the
+four domains and both machines clean: no organizational unit, account, share,
+folder, local group, membership, or profile of the fixture, and none of the
+residue that the check counts. Its verdict was CLEAN (11:45 UTC). The final
+read-only check of both labs after the whole run said CLEAN for the matrix lab
+(11:46 UTC) and for the first lab (11:46 UTC).
+
+### The module's own suite
+
+Passed / failed / skipped. Every configuration has 1,191 cases on the machines
+of the domain and on `OSWin11`, and 1,190 on the host, which has no DNS domain,
+so the test of the fully qualified name of this computer doesn't exist there
+([LocalSuite.csv](Acceptance-2026-10-20-published-rc8-LocalSuite.csv)).
+
+| Machine | Elevated, Windows PowerShell | Elevated, PowerShell 7 | Basic user, Windows PowerShell | Basic user, PowerShell 7 |
+| --- | --- | --- | --- | --- |
+| OSFile19 (Server 2019) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 |
+| OSFile22 (Server 2022) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 |
+| OSFile25 (Server 2025) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 |
+| OSWin11E (Windows 11 22H2) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 |
+| OSWin11 (Windows 11 26H1) | 1,172 / 0 / 19 | 1,170 / 0 / 21 | 907 / 0 / 284 | 905 / 0 / 286 |
+| Host (reference) | 1,171 / 0 / 19 | 1,169 / 0 / 21 | 906 / 0 / 284 | 904 / 0 / 286 |
+
+In all 20 comparisons with the host, the skipped tests are the same, name for
+name, as multisets (`Export-MatrixResults.ps1` found no difference). No run has
+a failed test, a failed container, or a test that didn't run. The operating
+system builds are those of the readiness checks (Windows Server 2019
+17763.1217, 2022 20348.4773, and 2025 26100.32690 on the domain controller and
+the file servers; Windows 11 22H2 22621.525 and 26H1 28000); the host has
+PowerShell 7.6.7, the virtual machines 7.6.3.
+
+After the suites, `Test-MatrixCleanup.ps1 -Mode Verify` checked the domain and
+the machines OSFile19, OSFile22, OSFile25, and OSWin11E again (11:26 UTC):
+CLEAN at the first check, so no repair was needed. A read-only script checked
+`OSWin11` with its local account (11:26 UTC): no scheduled task, stage item,
+probe user, profile, share, folder, or live user.
+
+### The long name of -ServerName
+
+The CHANGELOG says that `Get-NTFSEffectiveAccess` now writes a
+`GetEffectiveAccessError` for a computer name of 32,718 characters or more,
+because Windows refuses to start the authorization manager for it. A probe with
+the call and the structure of `Security2\Win32\Lib.cs`
+(`AuthzInitializeRemoteResourceManager`), run on the machines of the matrix lab
+after the acceptance, shows the same boundary on every one of them:
+
+| Machine | Operating system | 1 to 32,717 characters | 32,718 characters and more (also 32,768 and 70,000) |
+| --- | --- | --- | --- |
+| OSFile19 | Windows Server 2019 Datacenter 10.0.17763 | 1722 (RPC server unavailable) | 14 |
+| OSFile22 | Windows Server 2022 Datacenter 10.0.20348 | 1722 | 14 |
+| OSFile25 | Windows Server 2025 Datacenter 10.0.26100 | 1722 | 14 |
+| OSWin11 | Windows 11 Pro 10.0.28000 | 1722 | 14 |
+
+The probed lengths were 1, 255, 16,000, 32,717, 32,718, 32,768, and 70,000. On
+the host (Windows Server 2025), a bisection in both editions found the same
+boundary. Error 1722 keeps the fallback to this computer with its warning, and
+error 14 is the new error, so the regression test of the fix, which accepts
+either outcome, takes its error branch on each of these systems. `OSWin11E`
+was off when the probe ran and wasn't probed.
+
+## Limits and open items
+
+- This is one run of one binary. A changed binary needs the same cells again;
+  results of different binaries don't combine into one matrix. A stable 5.0.0
+  is a new build, because its manifest has no `Prerelease` value, so the
+  identity of the tested bytes doesn't carry over to it. The release procedure
+  (`Docs/Contributing/05-Releasing.md`) accepts the last prerelease instead;
+  that is the maintainer's decision, not this record's.
+- Case 9 (accounts of other domains and forests) needs trusts that the matrix
+  lab doesn't have, so the cells skip it, and it ran only in the first lab, on
+  Windows Server 2025. The first lab has no other operating system.
+- Windows 11 26H1 has no live cell: its secure channel to the Windows Server
+  2025 domain controller of the lab fails, so it runs the suite only. The client
+  of the cells is the Windows 11 22H2 evaluation build.
+- The file servers are Windows. A server of another kind is the subject of
+  Decision 23 (issue #34) and wasn't tested.
+- The matrix and its decision (Decision 24) are the maintainer's. This record is
+  the acceptance of the published rc8 on that matrix; whether the matrix is the
+  right one, and whether the gate is closed, are the maintainer's decisions.
+- `Test-MatrixCleanup.ps1` can't reach `OSWin11` with the domain account. The
+  read-only script that checked it with the local account is a helper of this
+  run (see the evidence), not a script of the kit.
+- `OSWin11E` shut itself down by itself after the run, as it does an hour after
+  every start (it was off at 11:51 UTC), and was left off. All the other
+  machines of both labs were saved again at 11:52 to 11:53 UTC; neither lab has
+  a fixture.
+- Of the two LOW findings of the security review in the record of the matrix,
+  the swallowed initialization exceptions of `GetEffectiveAccess` are fixed in
+  this build (#127). The ACL of the staging folders under `C:\` is unchanged and
+  wasn't part of this run.
+- The effective-access state that outlives a re-created account name wasn't
+  investigated again; the three cells of one sequence are no test of it. The
+  failures that the earlier record traced to it didn't recur.
+
+## Evidence
+
+The raw logs, result files, the downloaded packages, and the driver are local,
+outside Git, in the session files of the run (the folder `rc8-published`).
+`evidence-manifest.csv` there lists the size and the SHA-256 of every file
+except itself and the worktree of the tag, which holds the files of the commit
+that Git has. The helper scripts of the run are in the folder `scripts` next to
+it: the driver (`Chain-Published.ps1`), the restore of the machines
+(`Start-LabMachines.ps1`), the first-lab run with `-Version`
+(`Run-LiveAcceptancePublished.ps1`), the check of `OSWin11`
+(`Verify-Client.ps1`), and the exporter of the tables of this record
+(`Build-RecordTables.ps1`); the probe of the long name is
+`p-authz-init-lab.ps1` in `probes`. The tables of this record are next to it:
+
+- [the identity of the module files](Acceptance-2026-10-20-published-rc8-ModuleFiles.csv),
+- [the controller cells](Acceptance-2026-10-20-published-rc8-Cells.csv),
+- [the counts of the first-lab run](Acceptance-2026-10-20-published-rc8-FirstLab.csv),
+- [the suite results](Acceptance-2026-10-20-published-rc8-LocalSuite.csv).
+
+The scripts of the kit that ran are in [Acceptance](Acceptance); the decision is
+`.memory-bank\decisions\0024-os-matrix-lab.md`.
diff --git a/Tests/Lab/README.md b/Tests/Lab/README.md
index 9fc2a1d..e745638 100644
--- a/Tests/Lab/README.md
+++ b/Tests/Lab/README.md
@@ -164,7 +164,9 @@ and record the evidence in this folder:
    `.github\scripts\New-ModulePackage.ps1`, and record the SHA-256 of the
    packages and of the module files.
 2. Check that WinRM, LDAP, Kerberos, the secure channel, and the clocks of
-   the lab machines work.
+   the lab machines work. Machines that were saved (`Save-VM`) come first: restore
+   the domain controllers, wait a minute for the directory services, then restore
+   the other machines, and run the readiness check until it passes.
 3. Take a checkpoint of the machines, named after the candidate and its
    commit.
 4. Run the tests with `-ModulePath` of the extracted `NTFSSecurity.zip` in
@@ -249,15 +251,17 @@ module of the release (`Test-PublishedRelease.ps1` leaves it in the folder
 controller with `-Version` in the first lab, where case 9 runs. Start the suites
 a minute or more apart, because AutomatedLab imports one lab at a time, and
 never together with a controller. The
-[record of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) ran
-the stages that way.
+[record of the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md) and
+the [record of the published 5.0.0-rc8](Acceptance-2026-10-20-published-rc8.md)
+ran the stages that way.
 
 Records: [5.0.0-rc6](Acceptance-2026-10-08-5.0.0-rc6.md),
 [5.0.0-rc7](Acceptance-2026-10-08-5.0.0-rc7.md),
 [quality-gate follow-up](Acceptance-2026-10-09-quality-gate.md),
 [quality-gate paths follow-up](Acceptance-2026-10-09-quality-gate-paths.md),
-[operating-system matrix](Acceptance-2026-10-10-os-matrix.md), and
-[the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md).
+[operating-system matrix](Acceptance-2026-10-10-os-matrix.md),
+[the published 5.0.0-rc7](Acceptance-2026-10-10-published-rc7.md), and
+[the published 5.0.0-rc8](Acceptance-2026-10-20-published-rc8.md).
 The review of the code that no unit test visits, with the fixes that the lab
 has to repeat, is in
 [Tests/Coverage](../Coverage/Quality-Gate-Paths-2026-10-09.md).