From 2b974224b5c8a20c83cfebb0fc51c779570f09df Mon Sep 17 00:00:00 2001 From: Raimund Andree Date: Sun, 11 Oct 2026 00:46:18 +0000 Subject: [PATCH] docs(memory-bank): record Handoff 5 and its debugging lessons activeContext, progress, and techContext carry the final measurement (61e936e, built at 8a625c8), the acceptance of the final build, the open items for the maintainer, and the rule that the branch summary of the coverage tool is not read. systemPatterns names the culture-invariant matching of Get-ChildItem2 -Filter and the Get-Acl -Audit oracle. The new debugging-insights.md keeps the recurring defect classes of the work: culture-sensitive comparisons (including the ones inside AlphaFS), a test oracle that is wrong on a domain member, and a piped AppliesTo property that a path drops. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant --- .memory-bank/activeContext.md | 42 +++++++++++++++--------- .memory-bank/debugging-insights.md | 52 ++++++++++++++++++++++++++++++ .memory-bank/progress.md | 24 ++++++++------ .memory-bank/systemPatterns.md | 6 ++-- .memory-bank/techContext.md | 9 +++--- 5 files changed, 102 insertions(+), 31 deletions(-) create mode 100644 .memory-bank/debugging-insights.md diff --git a/.memory-bank/activeContext.md b/.memory-bank/activeContext.md index 95f0894..ebf7bac 100644 --- a/.memory-bank/activeContext.md +++ b/.memory-bank/activeContext.md @@ -9,17 +9,20 @@ source: current task evidence ## Current focus -State at 2026-10-10 22:00 UTC: Handoff 5 (the coverage unknowns) is done +State at 2026-10-11 00:55 UTC: Handoff 5 (the coverage unknowns) is done locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; nothing is pushed. The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md` with nine CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence points (87.64%); the live suite (first lab, three matrix cells) and the unit suite on a domain member add only 9 sequence and 4 explicit branch points, all -of `fdd7a8b`. One defect is fixed (`419cfb3`, an identity compared with a name -in `tr-TR`), 79 `It` blocks in four files are added (final commit `b2cb47b`: -1,455 cases per configuration, 3,243 points), and a defect is open (hard-link -names under a root that is not the volume root). The maintainer decides -whether the fix and the tests enter a new candidate. +of `fdd7a8b`. Two `tr-TR` defects are fixed test-first (`419cfb3`, an identity +compared with a name; `0028ccd`, `fbe0289`, `8a625c8`, `Get-ChildItem2 +-Filter`, found by the independent review), 79 `It` blocks in four files are +added (final commit `61e936e`, built once at `8a625c8`: 1,459 cases per +configuration, 3,258/3,664 points, 88.92%; the matrix suite passes on Windows +Server 2019, 2022, 2025 and Windows 11 in 16 configurations), and a defect is +open (hard-link names under a root that is not the volume root). The +maintainer decides whether the fixes and the tests enter a new candidate. State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120 @@ -126,8 +129,17 @@ acceptance is the maintainer's. audit read denial. The new tests add 45 points (getters of pipeline parameters; the paths report was wrong that no caller invokes a getter); 7 of 64 parameter sets closed, 51 partly, 1 open, 4 left to the maintainer. - Cultures `de-DE` and `tr-TR`: one defect, fixed (`419cfb3`). Not tested: - Server Core (plan), ARM64, a localized system, non-Windows servers. + Cultures `de-DE` and `tr-TR`: two defects, fixed (`419cfb3`; `0028ccd`, + `fbe0289`, `8a625c8`); the second was found by the one independent review + (`code-review`: four Major findings, all resolved; the later delta had no + second review). Final measurement + `61e936e` (build `8a625c8`): 1,459 cases per configuration, 3,258/3,664 + points, the same 187 unvisited methods; first lab 245/0/1 per edition on + that build; the 22 files of the matrix suite 1,156/0 in 16 configurations + on `OSFile19/22/25` and `OSWin11`; both labs clean at 00:43Z. The tool's + branch summary percentage is not read (it adds a point per method); the + explicit branch points are 1,090/1,168. Not tested: Server Core (plan), + ARM64, a localized system, non-Windows servers. - Raw evidence is outside git: the session folder `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the night log) and @@ -166,11 +178,11 @@ acceptance is the maintainer's. Modify; protecting them is a design change of the controller and needs a new acceptance). The help could also say that a local standard user who asks about a domain account still gets "Access is denied". -6. Handoff 5 is done (Evidence). The maintainer decides whether the fix - `419cfb3` and the tests enter a new candidate (rc8), which needs the matrix - cells and the first lab on its bytes, and he decides the open items of the - report: hard-link names under another root (a defect with a - reproduction), a piped `AppliesTo` property that doesn't select the Simple - set, 12 getters of pipeline parameters, the 52 partly closed sets, the audit - paths, Server Core (widens Decision 24), and ARM64. +6. Handoff 5 is done (Evidence). The maintainer decides whether the fixes + `419cfb3`, `0028ccd`, `fbe0289`, `8a625c8` and the tests enter a new + candidate (rc8), which needs the matrix cells and the first lab on its + bytes, and he decides the open items of the report: hard-link names under + another root (a defect with a reproduction), a piped `AppliesTo` property + that a path drops, 12 getters of pipeline parameters, the 51 partly closed + sets, the audit paths, Server Core (widens Decision 24), and ARM64. 7. Do not release stable 5.0.0 or equate a percentage with gate closure. diff --git a/.memory-bank/debugging-insights.md b/.memory-bank/debugging-insights.md new file mode 100644 index 0000000..fdb9a8b --- /dev/null +++ b/.memory-bank/debugging-insights.md @@ -0,0 +1,52 @@ +--- +status: current +last-verified: 2026-10-10 +owner: software-engineer +source: Handoff 5 (the coverage unknowns): probes, red and green runs, and the independent review +--- + +# Debugging insights + +Recurring defect classes and how to find them. Evidence is in +`Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`; a fix needs a test that +fails without it (Decision 16). + +## Culture-sensitive comparison (`tr-TR`) + +- With `tr-TR`, `I` and `i` are different letters, so a comparison that takes + the culture of the thread drops or misses items: `string.Equals` without a + comparer, a case-insensitive `Regex`, a `WildcardPattern` without + `CultureInvariant`. Handoff 5 found two defects of this class: + `IdentityReference2.Equals(object)` called with a name (now + `OrdinalIgnoreCase`) and `Get-ChildItem2 -Filter` (`index*` did not list + `Index.txt`). +- A scan of the C# is not enough: AlphaFS 2.2 builds a culture-sensitive regex + from a search pattern. `Get-ChildItem2` therefore enumerates under + `InvariantCultureScope` (around the creation of the enumerator and each + `MoveNext`, never across a `WriteObject`) and its own `WildcardPattern` has + `CultureInvariant`. Check any new library call that takes a user pattern. +- PowerShell `-eq`, `-contains`, and `-in` do not take the thread culture; + only the .NET method call failed. Probe a claim before it enters the + changelog or a report (the first wording named `-eq` and was wrong). +- A test sets the culture of the thread, restores it in `finally`, names the + rows that differ (`index*`, `*.INI`), keeps a control (`INDEX*`), and is + proved red on the previous build and green on the new one in all four + configurations (`Tests/ItemCmdlets.Tests.ps1`, `Tests/ObjectApis.Tests.ps1`). + +## A test oracle that is wrong on a domain member + +- `Get-Acl -Audit` reads the SACL with the other sections and reports an item + without audit entries as protected (Windows Server 2019, 2022, and 2025 + domain members, Windows 11); the module and `Get-NTFSInheritance` read the + SACL alone. Tests read the flag with .NET `GetAccessControl(Audit)` + (`Get-TestAuditAcl`). A suite that is green on the host proves nothing about + an oracle: run a new test on a domain member before calling it done. + +## A piped property and the parameter set + +- An object with a property `AppliesTo`, piped into `Add-` or + `Remove-NTFSAccess` or `-NTFSAudit` with a path, binds the default + `PathComplex` set and drops the property; with a descriptor it binds + `SDSimple`. A test that means the Simple set names `-AppliesTo` and asserts + the scope it gets (a probe that tells the sets uses an entry of the default + scope: removing `ThisFolderOnly` from it leaves the `InheritOnly` part). diff --git a/.memory-bank/progress.md b/.memory-bank/progress.md index 95783d8..ca8407b 100644 --- a/.memory-bank/progress.md +++ b/.memory-bank/progress.md @@ -102,11 +102,14 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). - 2026-10-10: Handoff 5, the coverage unknowns (local, `ai/coverage-unknowns`, nothing pushed). rc7 measured at `fa0701b`: 3,198/3,649 sequence points; the live suite and the suite on a domain member add 9 sequence and 4 - explicit branch points (`fdd7a8b`); one defect fixed (`419cfb3`, `tr-TR`), - 79 `It` blocks added (`b2cb47b`: 1,455 cases per configuration, 3,243 - points); the getter rule of the paths report corrected; the first lab - accepted on the fixed build. Open: hard-link names under another root, a - piped `AppliesTo`, Server Core, ARM64. Report: + explicit branch points (`fdd7a8b`); two `tr-TR` defects fixed test-first + (`419cfb3`; `0028ccd`, `fbe0289`, `8a625c8`, the second found by the + independent review); 79 `It` blocks added (final `61e936e`, built at + `8a625c8`: 1,459 cases per configuration, 3,258/3,664 points); the getter + rule of the paths report corrected; the first lab accepted on the fixed + builds and the matrix suite passing on Windows Server 2019, 2022, 2025 and + Windows 11 (1,156 cases, 16 configurations). Open: hard-link names under + another root, a piped `AppliesTo` for a path, Server Core, ARM64. Report: `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`. ## Stable capabilities @@ -145,17 +148,18 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18). wiki editing restrictions, `test/transfer`, and old lab checkpoints when no longer needed. No remote changes or snapshot restores here. 7. Remaining-path inventory at the final frozen commit of Handoff 5 - (`b2cb47b`): 406 unvisited sequence points in 187 methods, all classified + (`61e936e`): 406 unvisited sequence points in 187 methods, all classified (`Tests/Coverage`): 167 explained from source with evidence, 20 open (8: `FileSecurity` conversions, `RemoveAll` account filters; 12 getters of pipeline parameters that no test binds by property name). Other open decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on - what a later command raises (a rare combination), unused classes. An audit - write's ownership retry cannot run on a local volume or on a Windows file - server (probe) and no test reaches it. A conditional ACE display remains a - .NET representation limit, not evidence of unconditional permissions. + what a later command raises (a rare combination), unused classes. No + trigger for an audit write's ownership retry was found on a local volume or + a Windows file server (probe of 48 calls) and no test reaches it. A + conditional ACE display remains a .NET representation limit, not evidence + of unconditional permissions. 8. Publication recovery (`95b827e`, merged in #120): 14 offline tests and exact artifact SHA-512 verification; the original upload errors remain errors for missing, different, or unverifiable outcomes. The agent published nothing, diff --git a/.memory-bank/systemPatterns.md b/.memory-bank/systemPatterns.md index 7beb0f0..cfa6c70 100644 --- a/.memory-bank/systemPatterns.md +++ b/.memory-bank/systemPatterns.md @@ -70,8 +70,8 @@ Read only task-relevant records; the index controls routing. through a Write call (`IsFromLaterCommand`, `PipelineControl`; see `BaseCmdlets.cs`); add a row to `Tests/PipelineControl.Tests.ps1` for a new cmdlet. Record an enabled privilege before the next write. -- `Get-ChildItem2 -Filter` has two matchers (AlphaFS, then a wildcard on the - name); `*.*` means `*`, other dot patterns are an open decision. +- `Get-ChildItem2 -Filter`: AlphaFS, then a wildcard on the name, both culture + invariant (`debugging-insights.md`); `*.*` means `*`, dot rules are open. ### Tests and documentation @@ -95,6 +95,8 @@ Read only task-relevant records; the index controls routing. member or another token (the matrix found three): also run a domain member, other builds, and a basic user. A failure that follows cell order, not version, points to stale account state (Decision 24): alternate the cells. + Oracles differ there too: `Get-Acl -Audit` reads an item without audit + entries as SACL-protected, so a test reads the SACL alone (.NET). ### CI, publication, and integration diff --git a/.memory-bank/techContext.md b/.memory-bank/techContext.md index e20cce2..71585a6 100644 --- a/.memory-bank/techContext.md +++ b/.memory-bank/techContext.md @@ -107,10 +107,11 @@ source: repository and executable evidence before passing native arguments, not inline Join-Path expressions. - Report sequence points, not unique source lines. Four-run baselines: `3442194` 2,641/3,559 (74.21%); `5a5d58b` 3,192/3,634 (87.84%); `fa0701b` - (rc7) 3,198/3,649 (87.64%); `b2cb47b` 3,243/3,649 (88.87%). The code + (rc7) 3,198/3,649 (87.64%); `61e936e` 3,258/3,664 (88.92%). The code changes the denominators: never present these as same-source increments. - The branch summary counts 821 compiler-generated points; report the - explicit branch points too (1,090/1,168, 93.32%). Suite at `b2cb47b`: 1,455 + The branch summary of the tool adds a point to most methods (never visited + for the 626 without a branch): report the explicit branch points + (1,090/1,168, 93.32%), not the summary percentage. Suite at `61e936e`: 1,459 per configuration, zero failures (skipped: 26 and 57 elevated, 276 and 307 basic, Desktop and Core). - NUnit skipped ForEach names retain placeholders and parameter tuples, @@ -128,7 +129,7 @@ source: repository and executable evidence logged a flush. Merge by position, never by `uspid`. PowerShell reads the getter of a parameter that it binds from a piped object: unvisited getters point at missing pipeline tests. -- Remaining inventory at `b2cb47b`: 406 points in 187 methods, classified by +- Remaining inventory at `61e936e`: 406 points in 187 methods, classified by rule (`Tests/Coverage`). Preserve raw XML, row CSVs, logs, commit identity, and build hashes: the frozen Build rewrites its hash file, so save the hashes of the measured assemblies (AltCover `__Saved` copies) first.