docs(memory-bank): record Handoff 5 and its debugging lessons

activeContext, progress, and techContext carry the final measurement (61e936e,
built at 8a625c8), the acceptance of the final build, the open items for the
maintainer, and the rule that the branch summary of the coverage tool is not
read. systemPatterns names the culture-invariant matching of Get-ChildItem2
-Filter and the Get-Acl -Audit oracle. The new debugging-insights.md keeps the
recurring defect classes of the work: culture-sensitive comparisons (including
the ones inside AlphaFS), a test oracle that is wrong on a domain member, and a
piped AppliesTo property that a path drops.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -9,17 +9,20 @@ source: current task evidence
 
 ## Current focus
 
-State at 2026-10-10 22:00 UTC: Handoff 5 (the coverage unknowns) is done
+State at 2026-10-11 00:55 UTC: Handoff 5 (the coverage unknowns) is done
 locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; nothing is
 pushed. The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`
 with nine CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence
 points (87.64%); the live suite (first lab, three matrix cells) and the unit
 suite on a domain member add only 9 sequence and 4 explicit branch points, all
-of `fdd7a8b`. One defect is fixed (`419cfb3`, an identity compared with a name
-in `tr-TR`), 79 `It` blocks in four files are added (final commit `b2cb47b`:
-1,455 cases per configuration, 3,243 points), and a defect is open (hard-link
-names under a root that is not the volume root). The maintainer decides
-whether the fix and the tests enter a new candidate.
+of `fdd7a8b`. Two `tr-TR` defects are fixed test-first (`419cfb3`, an identity
+compared with a name; `0028ccd`, `fbe0289`, `8a625c8`, `Get-ChildItem2
+-Filter`, found by the independent review), 79 `It` blocks in four files are
+added (final commit `61e936e`, built once at `8a625c8`: 1,459 cases per
+configuration, 3,258/3,664 points, 88.92%; the matrix suite passes on Windows
+Server 2019, 2022, 2025 and Windows 11 in 16 configurations), and a defect is
+open (hard-link names under a root that is not the volume root). The
+maintainer decides whether the fixes and the tests enter a new candidate.
 
 State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack
 into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120
@@ -126,8 +129,17 @@ acceptance is the maintainer's.
   audit read denial. The new tests add 45 points (getters of pipeline
   parameters; the paths report was wrong that no caller invokes a getter);
   7 of 64 parameter sets closed, 51 partly, 1 open, 4 left to the maintainer.
-  Cultures `de-DE` and `tr-TR`: one defect, fixed (`419cfb3`). Not tested:
-  Server Core (plan), ARM64, a localized system, non-Windows servers.
+  Cultures `de-DE` and `tr-TR`: two defects, fixed (`419cfb3`; `0028ccd`,
+  `fbe0289`, `8a625c8`); the second was found by the one independent review
+  (`code-review`: four Major findings, all resolved; the later delta had no
+  second review). Final measurement
+  `61e936e` (build `8a625c8`): 1,459 cases per configuration, 3,258/3,664
+  points, the same 187 unvisited methods; first lab 245/0/1 per edition on
+  that build; the 22 files of the matrix suite 1,156/0 in 16 configurations
+  on `OSFile19/22/25` and `OSWin11`; both labs clean at 00:43Z. The tool's
+  branch summary percentage is not read (it adds a point per method); the
+  explicit branch points are 1,090/1,168. Not tested: Server Core (plan),
+  ARM64, a localized system, non-Windows servers.
 - Raw evidence is outside git: the session folder
   `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the
   night log) and
@@ -166,11 +178,11 @@ acceptance is the maintainer's.
    Modify; protecting them is a design change of the controller and needs a new
    acceptance). The help could also say that a local standard user who asks
    about a domain account still gets "Access is denied".
-6. Handoff 5 is done (Evidence). The maintainer decides whether the fix
-   `419cfb3` and the tests enter a new candidate (rc8), which needs the matrix
-   cells and the first lab on its bytes, and he decides the open items of the
-   report: hard-link names under another root (a defect with a
-   reproduction), a piped `AppliesTo` property that doesn't select the Simple
-   set, 12 getters of pipeline parameters, the 52 partly closed sets, the audit
-   paths, Server Core (widens Decision 24), and ARM64.
+6. Handoff 5 is done (Evidence). The maintainer decides whether the fixes
+   `419cfb3`, `0028ccd`, `fbe0289`, `8a625c8` and the tests enter a new
+   candidate (rc8), which needs the matrix cells and the first lab on its
+   bytes, and he decides the open items of the report: hard-link names under
+   another root (a defect with a reproduction), a piped `AppliesTo` property
+   that a path drops, 12 getters of pipeline parameters, the 51 partly closed
+   sets, the audit paths, Server Core (widens Decision 24), and ARM64.
 7. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/debugging-insights.md

@@ -0,0 +1,52 @@
+---
+status: current
+last-verified: 2026-10-10
+owner: software-engineer
+source: Handoff 5 (the coverage unknowns): probes, red and green runs, and the independent review
+---
+
+# Debugging insights
+
+Recurring defect classes and how to find them. Evidence is in
+`Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`; a fix needs a test that
+fails without it (Decision 16).
+
+## Culture-sensitive comparison (`tr-TR`)
+
+- With `tr-TR`, `I` and `i` are different letters, so a comparison that takes
+  the culture of the thread drops or misses items: `string.Equals` without a
+  comparer, a case-insensitive `Regex`, a `WildcardPattern` without
+  `CultureInvariant`. Handoff 5 found two defects of this class:
+  `IdentityReference2.Equals(object)` called with a name (now
+  `OrdinalIgnoreCase`) and `Get-ChildItem2 -Filter` (`index*` did not list
+  `Index.txt`).
+- A scan of the C# is not enough: AlphaFS 2.2 builds a culture-sensitive regex
+  from a search pattern. `Get-ChildItem2` therefore enumerates under
+  `InvariantCultureScope` (around the creation of the enumerator and each
+  `MoveNext`, never across a `WriteObject`) and its own `WildcardPattern` has
+  `CultureInvariant`. Check any new library call that takes a user pattern.
+- PowerShell `-eq`, `-contains`, and `-in` do not take the thread culture;
+  only the .NET method call failed. Probe a claim before it enters the
+  changelog or a report (the first wording named `-eq` and was wrong).
+- A test sets the culture of the thread, restores it in `finally`, names the
+  rows that differ (`index*`, `*.INI`), keeps a control (`INDEX*`), and is
+  proved red on the previous build and green on the new one in all four
+  configurations (`Tests/ItemCmdlets.Tests.ps1`, `Tests/ObjectApis.Tests.ps1`).
+
+## A test oracle that is wrong on a domain member
+
+- `Get-Acl -Audit` reads the SACL with the other sections and reports an item
+  without audit entries as protected (Windows Server 2019, 2022, and 2025
+  domain members, Windows 11); the module and `Get-NTFSInheritance` read the
+  SACL alone. Tests read the flag with .NET `GetAccessControl(Audit)`
+  (`Get-TestAuditAcl`). A suite that is green on the host proves nothing about
+  an oracle: run a new test on a domain member before calling it done.
+
+## A piped property and the parameter set
+
+- An object with a property `AppliesTo`, piped into `Add-` or
+  `Remove-NTFSAccess` or `-NTFSAudit` with a path, binds the default
+  `PathComplex` set and drops the property; with a descriptor it binds
+  `SDSimple`. A test that means the Simple set names `-AppliesTo` and asserts
+  the scope it gets (a probe that tells the sets uses an entry of the default
+  scope: removing `ThisFolderOnly` from it leaves the `InheritOnly` part).

.memory-bank/progress.md

@@ -102,11 +102,14 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 - 2026-10-10: Handoff 5, the coverage unknowns (local, `ai/coverage-unknowns`,
   nothing pushed). rc7 measured at `fa0701b`: 3,198/3,649 sequence points;
   the live suite and the suite on a domain member add 9 sequence and 4
-  explicit branch points (`fdd7a8b`); one defect fixed (`419cfb3`, `tr-TR`),
-  79 `It` blocks added (`b2cb47b`: 1,455 cases per configuration, 3,243
-  points); the getter rule of the paths report corrected; the first lab
-  accepted on the fixed build. Open: hard-link names under another root, a
-  piped `AppliesTo`, Server Core, ARM64. Report:
+  explicit branch points (`fdd7a8b`); two `tr-TR` defects fixed test-first
+  (`419cfb3`; `0028ccd`, `fbe0289`, `8a625c8`, the second found by the
+  independent review); 79 `It` blocks added (final `61e936e`, built at
+  `8a625c8`: 1,459 cases per configuration, 3,258/3,664 points); the getter
+  rule of the paths report corrected; the first lab accepted on the fixed
+  builds and the matrix suite passing on Windows Server 2019, 2022, 2025 and
+  Windows 11 (1,156 cases, 16 configurations). Open: hard-link names under
+  another root, a piped `AppliesTo` for a path, Server Core, ARM64. Report:
   `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`.
 
 ## Stable capabilities
@@ -145,17 +148,18 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
    wiki editing restrictions, `test/transfer`, and old lab checkpoints
    when no longer needed. No remote changes or snapshot restores here.
 7. Remaining-path inventory at the final frozen commit of Handoff 5
-   (`b2cb47b`): 406 unvisited sequence points in 187 methods, all classified
+   (`61e936e`): 406 unvisited sequence points in 187 methods, all classified
    (`Tests/Coverage`): 167 explained from source with evidence, 20 open (8:
    `FileSecurity` conversions, `RemoveAll` account filters; 12 getters of
    pipeline parameters that no test binds by property name). Other open
    decisions: lazy path overloads, abandoned
    `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17
    owner-restore handlers that do not pass on
-   what a later command raises (a rare combination), unused classes. An audit
-   write's ownership retry cannot run on a local volume or on a Windows file
-   server (probe) and no test reaches it. A conditional ACE display remains a
-   .NET representation limit, not evidence of unconditional permissions.
+   what a later command raises (a rare combination), unused classes. No
+   trigger for an audit write's ownership retry was found on a local volume or
+   a Windows file server (probe of 48 calls) and no test reaches it. A
+   conditional ACE display remains a .NET representation limit, not evidence
+   of unconditional permissions.
 8. Publication recovery (`95b827e`, merged in #120): 14 offline tests and exact
    artifact SHA-512 verification; the original upload errors remain errors for
    missing, different, or unverifiable outcomes. The agent published nothing,

.memory-bank/systemPatterns.md

@@ -70,8 +70,8 @@ Read only task-relevant records; the index controls routing.
   through a Write call (`IsFromLaterCommand`, `PipelineControl`; see
   `BaseCmdlets.cs`); add a row to `Tests/PipelineControl.Tests.ps1` for a new
   cmdlet. Record an enabled privilege before the next write.
-- `Get-ChildItem2 -Filter` has two matchers (AlphaFS, then a wildcard on the
-  name); `*.*` means `*`, other dot patterns are an open decision.
+- `Get-ChildItem2 -Filter`: AlphaFS, then a wildcard on the name, both culture
+  invariant (`debugging-insights.md`); `*.*` means `*`, dot rules are open.
 
 ### Tests and documentation
 
@@ -95,6 +95,8 @@ Read only task-relevant records; the index controls routing.
   member or another token (the matrix found three): also run a domain member,
   other builds, and a basic user. A failure that follows cell order, not
   version, points to stale account state (Decision 24): alternate the cells.
+  Oracles differ there too: `Get-Acl -Audit` reads an item without audit
+  entries as SACL-protected, so a test reads the SACL alone (.NET).
 
 ### CI, publication, and integration
 

.memory-bank/techContext.md

@@ -107,10 +107,11 @@ source: repository and executable evidence
   before passing native arguments, not inline Join-Path expressions.
 - Report sequence points, not unique source lines. Four-run baselines:
   `3442194` 2,641/3,559 (74.21%); `5a5d58b` 3,192/3,634 (87.84%); `fa0701b`
-  (rc7) 3,198/3,649 (87.64%); `b2cb47b` 3,243/3,649 (88.87%). The code
+  (rc7) 3,198/3,649 (87.64%); `61e936e` 3,258/3,664 (88.92%). The code
   changes the denominators: never present these as same-source increments.
-  The branch summary counts 821 compiler-generated points; report the
-  explicit branch points too (1,090/1,168, 93.32%). Suite at `b2cb47b`: 1,455
+  The branch summary of the tool adds a point to most methods (never visited
+  for the 626 without a branch): report the explicit branch points
+  (1,090/1,168, 93.32%), not the summary percentage. Suite at `61e936e`: 1,459
   per configuration, zero failures (skipped: 26 and 57 elevated, 276 and 307
   basic, Desktop and Core).
 - NUnit skipped ForEach names retain placeholders and parameter tuples,
@@ -128,7 +129,7 @@ source: repository and executable evidence
   logged a flush. Merge by position, never by `uspid`. PowerShell reads the
   getter of a parameter that it binds from a piped object: unvisited getters
   point at missing pipeline tests.
-- Remaining inventory at `b2cb47b`: 406 points in 187 methods, classified by
+- Remaining inventory at `61e936e`: 406 points in 187 methods, classified by
   rule (`Tests/Coverage`). Preserve raw XML, row CSVs, logs, commit identity,
   and build hashes: the frozen Build rewrites its hash file, so save the
   hashes of the measured assemblies (AltCover `__Saved` copies) first.