docs: add the quality-gate path report with its evidence tables

Handoff 1 of the pre-5.0.0 quality gate. The report classifies every
C# method that no test visited at 5a5d58b (231 methods, 442 sequence
points: 223 explained, 8 open for the maintainer) and records the
measurement (3,192/3,634 sequence points, 87.84%), 26 bounded
mutations, a red/green matrix of the fix commits over ten states of
the branch, the open items, the handoff to gate 3, and nine static
review passes. The CSV files hold the method, cmdlet, and parameter
set tables, the guard rows of the matrix with their test files, and
the SHA-256 of each of its 40 logs.

The Memory Bank notes (active context, progress, tech context, system
patterns) and the lab README point to it. No code, test, or help
changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -9,14 +9,18 @@ source: current task evidence
 
 ## Current focus
 
-Handoff 1 is in progress on `ai/quality-gate-paths`, from reviewed #117
-head `f11ff41`. Both stacked PRs are open and green; rc6 remains the latest
-published candidate and 4.2.6 the stable Gallery version. Public rule-path,
-simplified-audit, and boxed privilege-comparison defects were reproduced
-and fixed test-first. New descriptor, native-identity, audit-capability and
-recursive-denial guards pass focused checks. Frozen full-suite coverage,
-complete path explanations and the requested independent review follow.
-The shared lab and remotes are unchanged. Decisions 21/22 and stable 5.0.0
+Handoff 1 of the quality gate is finished locally on `ai/quality-gate-paths`,
+from the reviewed head `f11ff41` of #117: 28 commits, nothing pushed. Both
+stacked PRs stay open and green; rc6 remains the latest published
+candidate and 4.2.6 the stable Gallery version. Every C# method that no test
+visits is classified (223 explained, 8 open for the maintainer), and the
+other paths have behavior tests. Eleven defects were fixed, ten of them
+with a regression guard that is red before the fix and green after it (owner
+restore, `InheritedFrom`, a later command that ends the pipeline or throws,
+also at the error, verbose, and debug streams, `-Filter` brackets, null, and
+`*.*`, public object APIs, a privilege left enabled); the leak of a native
+buffer has no observable guard. Gate 3 must repeat the affected lab acceptance
+before the next candidate is published. Decisions 21/22 and stable 5.0.0
 remain gated; Decision 22 is proposed, not accepted.
 
 ## Evidence
@@ -33,11 +37,41 @@ remain gated; Decision 22 is proposed, not accepted.
 - Hidden omission was reproduced in all four configurations before the
   fix. No parameter/design change. Publication tests are wholly mocked;
   exact ordinal SHA-512 identity is required, no real upload occurred.
-- Final uninstrumented suite: 914 each, zero failed. Passed/skipped:
-  elevated Desktop 890/24, Core 860/54; basic Desktop 749/165, Core 719/195.
-  Frozen aggregate: 2,641/3,559 sequence (74.21%), 974/1,933 branches
-  (50.39%); NTFSSecurity assembly 84.28%. All skipped templates have
-  executed counterparts; mutations restored exactly before green builds.
+- At `3442194` (start of Handoff 1): 914 cases per configuration, 2,641/3,559
+  sequence points (74.21%), 974/1,933 branches (50.39%), 918 unvisited
+  points. All skipped templates had executed counterparts.
+- Handoff 1 result at `5a5d58b` (frozen Release, four configurations, CI
+  wrappers, then AltCover): 1,310 cases per configuration, zero failures;
+  passed/skipped: elevated Desktop 1,286/24, Core 1,255/55; basic Desktop
+  1,076/234, Core 1,045/265. Coverage 3,192/3,634 sequence points (87.84%),
+  1,273/1,978 branches (64.36%); 231 methods with 442 points stay unvisited,
+  all classified: 223 explained, 8 open. Skip eligibility was checked by row
+  from a second full run per configuration: all 578 skipped rows (137
+  distinct tests) are executed in two other configurations.
+- Mutation rounds on the frozen tree at `5a5d58b`: 26 mutations in four
+  rounds; 25 are detected by their guard in every configuration where it
+  runs, and M25 (the check by type, an equivalent mutant) survives as
+  expected. At `d61dffa` three had escaped (the verbose and debug rows ran
+  under the CI runner's `Stop`, and an Init test could not fail for its
+  branch), which led to `f4a16e1`. A first round at `630926f` had let one
+  mutation escape, which led to the `-Filter` bracket defect.
+- Red/green matrix (measured after the last measurement, because the first
+  red runs were not kept): the final tests of the eight files that guard the
+  fixes (650 cases per configuration) over the production code of ten states
+  of the branch, built in Release and run with the focused runner (it sets
+  `Stop` like the CI wrappers) in the four configurations. 76 rows (73 in the
+  basic configurations) fail at the base `f11ff41`, each is green at the step
+  of its fix, none breaks later, and `d44a200` has none (the control). Defect
+  9 (the native buffer) has no guard. The matrix does not show that a test was
+  written before its fix: each fix commit carries both, and the red runs of
+  that time were not kept.
+- Review: custom `security-reviewer` could not start (model unavailable); the
+  built-in read-only `code-review` agent made nine static passes: no Blocker
+  or Major; its Minor findings led to the `*.*`, help, test, later-command,
+  error-stream, and privilege fixes. Report:
+  `Tests/Coverage/Quality-Gate-Paths-2026-10-09.md` with an appendix of
+  explanations and CSV rows; raw evidence is in the session folder
+  `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files\qg-paths`.
 - Live packaged candidate, 09:20 to 09:51 UTC: 330 passed, zero failed,
   two expected Server-module skips. Published rc6: 326 passed, four
   expected failures (Hidden and rc7 warning text in each edition), two
@@ -47,9 +81,8 @@ remain gated; Decision 22 is proposed, not accepted.
   both editions. Cleanup wrapper's broad Error.Count was not acceptance
   proof. Independent probes verified all fixture objects/members/profiles
   gone from six machines. Raw failing markers and corrected evidence kept.
-- One read-only independent code review approved, high confidence, no
-  significant findings or confirmed exploit. Custom reviewer could not
-  start (model unavailable); built-in code-review performed the one pass.
+- Review of the lab candidate: one read-only independent code review
+  approved, high confidence, no significant findings or confirmed exploit.
 - Six checkpoints exist but report Standard, even after a successful
   temporary ProductionOnly probe; policy restored, no restore performed.
   Do not claim verified Production rollback evidence.
@@ -60,10 +93,16 @@ remain gated; Decision 22 is proposed, not accepted.
 
 ## Next step
 
-1. Finish Handoff 1: freeze Release source, prove characterization guards,
-   run all four configurations, classify every refreshed gap and review.
-2. Send code fixes and persistent evidence to gate 3 before publication;
-   repeat affected packaged acceptance after integration. No local upload.
+1. The maintainer reviews and integrates `ai/quality-gate-paths` (stacked on
+   #117; no remote change was made here) and decides the open items listed
+   in the report: `FileSecurity` conversions, `RemoveAll` account filters,
+   lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns of
+   `Get-ChildItem2 -Filter`, the 17 owner-restore handlers without the
+   later-command check, unused classes (Decisions 21/22).
+2. Gate 3: repeat the affected packaged acceptance (the report's handoff
+   table: owner restore, `InheritedFrom`, later-command exceptions, filter,
+   privileges, public objects) before the next candidate is published. No
+   local upload.
 3. Retain stacked-PR order (15), obtain Decision 22 review, finish the OS
    matrix and obtain or explicitly accept #34 feedback through other gates.
 4. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/progress.md

@@ -12,8 +12,9 @@ source: repository and validation evidence
 5.0.0-rc6 is published on the Gallery and GitHub; its failed Release job
 recovered in attempt 2 on 2026-10-09. #116 (rc7, `d25647d`, base `master`)
 is open and green, not merged or published. Further quality-gate work is
-local on `ai/quality-gate-coverage`; Phase 2 is not complete while the
-remaining-path inventory is open. Stable Gallery version: 4.2.6.
+local: `ai/quality-gate-coverage` (#117) and `ai/quality-gate-paths`, which
+classifies every remaining unvisited path; the open items are the
+maintainer's decisions. Stable Gallery version: 4.2.6.
 After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 
 ## Recent milestones
@@ -62,6 +63,17 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   Lab guards/acceptance committed in `7594e0c`. One independent code review
   approved with no significant finding (custom model unavailable; built-in
   fallback). All 11 tested files match the ZIP. OS/path gates stay open.
+- 2026-10-09: Handoff 1 on `ai/quality-gate-paths` (28 local commits, no
+  push): suite 914 to 1,310 per configuration, zero failures; coverage
+  3,192/3,634 sequence points (87.84%), 1,273/1,978 branches; all 231
+  unvisited methods classified (223 explained, 8 open). Eleven defects
+  fixed, ten with a guard that is red before the fix and green after it (a
+  red/green matrix over ten states of the branch: 76 rows red at the base,
+  none after the last fix), among them a later command's exception that
+  cmdlets swallowed (a `throw` made `Remove-Item2` remove the next item; also
+  through the error stream) and a privilege left enabled. Nine static
+  passes of the built-in code-review agent: no Blocker or Major. Report in
+  `Tests/Coverage`.
 
 ## Stable capabilities
 
@@ -97,17 +109,16 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 6. Optional maintainer cleanup: obsolete AppVeyor/Read the Docs access,
    wiki editing restrictions, `test/transfer`, and old lab checkpoints
    when no longer needed. No remote changes or snapshot restores here.
-7. Fresh coverage inventory at `3442194`: 918 unvisited sequence points.
-   Of these, 244 are in classes unused by cmdlets and 112 in parameter
-   getters; 562 remain for finer review/testing, including unused overloads,
-   defensive/native failures, and environment-specific branches. High-value
-   local gaps closed: folders/Force/DeleteError, RestoreOwnerError, all
-   scopes, file/folder inheritance, enumeration/depth/link skipping,
-   descriptor write failures, and forced file replacement. Remaining
-   candidates: audit ownership-retry failures, SD inheritance edge cases,
-   effective-access unresolved identity, recursive denial/error surfaces,
-   output-object comparisons/formatting. A conditional ACE display remains
-   a .NET representation limit, not evidence of unconditional permissions.
+7. Remaining-path inventory at the final frozen commit of Handoff 1:
+   442 unvisited sequence points in 231 methods, all classified
+   (`Tests/Coverage`): 223 explained from source with evidence, 8 open
+   (`FileSecurity` conversions, `RemoveAll` account filters). Other open
+   decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns
+   of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on
+   what a later command raises (a rare combination), unused classes. An audit
+   write's ownership retry cannot run on a local volume and is covered only
+   by the lab. A conditional ACE display remains a .NET representation limit,
+   not evidence of unconditional permissions.
 8. Publication recovery is implemented locally in `95b827e`, with 14 offline
    tests and exact artifact SHA-512 verification. Original upload errors
    remain errors for missing/different/unverifiable outcomes. Not deployed

.memory-bank/systemPatterns.md

@@ -64,6 +64,25 @@ Read only task-relevant records; the index controls routing.
 - Pipeline getters never throw; per-item errors name input and allow continuation.
 - Folder moves never use CopyAllowed; preserve cross-volume source folders.
 - Apply implied Hidden/Force before deciding to emit, including the first item.
+- A catch-all for the failures of one item must pass on what a later command
+  raises through a Write call. A downstream throw is an ordinary exception,
+  so a type check finds only the end of the pipeline, break, and continue.
+  BaseCmdlet notes the exception that its WriteObject, WriteError,
+  WriteVerbose, and WriteDebug raised (WriteWarning is not noted: no catch-all
+  encloses it); `IsFromLaterCommand` recognizes it, and the type check
+  `PipelineControl.IsEnd` backs it up for other calls into PowerShell. A write
+  inside a helper, such as the owner restore of `InvokeAsOwner`, is an
+  accepted gap: its handler reports the item's own error, which raises too.
+  Prefer writing outside the try. `Tests/PipelineControl.Tests.ps1` has rows
+  for every cmdlet: add a row for a new one, and keep the typed-throw rows
+  (they fail if PowerShell stops wrapping a thrown exception).
+- Record an enabled privilege before the next write, which a later command
+  can answer with an exception: Dispose disables only what is recorded.
+- `Get-ChildItem2 -Filter` has two matchers: the AlphaFS enumeration, whose
+  dot rules also differ from those of `Get-ChildItem` (probe: `Report.*` and
+  `Rep*.` in both editions), and a PowerShell wildcard on the name, where only
+  `*` and `?` are special. `*.*` is treated as `*`; the other dot patterns are
+  pinned by `ItemCmdlets.Tests` and are an open maintainer decision.
 
 ### Tests and documentation
 
@@ -73,9 +92,24 @@ Read only task-relevant records; the index controls routing.
 - Assert persisted state, errors/targets, continuation, and no failed
   PassThru output. Prove new characterization guards with bounded mutations;
   restore source exactly and rebuild before green validation or packaging.
+  Apply the mutations of one round together only when no guard can fail
+  because of another mutation; otherwise split the rounds.
+- A test that arranges a retry asserts its precondition (the plain write is
+  denied), or it can pass without reaching the retry.
+- A test variable must not take the name of an automatic variable such as
+  `$foreach`: Pester runs the block inside a foreach, and the value is lost.
+- The CI scripts set `$ErrorActionPreference = 'Stop'`; focused runs do the
+  same, and a test that needs a non-terminating error (for example to take it
+  through `2>&1`) names `-ErrorAction Continue`.
 - Fixture DACLs use .NET SetAccessControl, not Set-Acl's unintended SACL writes.
 - Scope/descendant expectations are independent of the production converter.
+- Drive-root tests map a sandbox folder with `subst` through
+  `New-TestDriveMapping` (elevated only; the basic token cannot). Tests that
+  need a letter without a volume take the lowest free one.
 - Desktop platyPS: generate help, rebuild, round-trip unchanged, check links.
+  platyPS 0.14.2 turns a pair of asterisks in a paragraph into emphasis, also
+  inside backticks, and the help drops them: write the words, put patterns in
+  example code blocks, and check the generated XML.
 - Live tests use only approved lab targets, SMB then independent server state;
   Get/SetFileSecurity preserves stored DACLs; rights oracles use S4U tokens.
 

.memory-bank/techContext.md

@@ -115,19 +115,42 @@ source: repository and executable evidence
 - Report sequence points, not unique source lines. Four-run baselines:
   rc5 2,020/3,476 (58.1%), branches 711/1,873 (38.0%);
   rc6 2,412/3,540 (68.14%), branches 850/1,918 (44.32%);
-  follow-up `3442194` 2,641/3,559 (74.21%), 974/1,933 (50.39%).
-  NTFSSecurity assembly: 1,769/2,099 (84.28%). Different code changes
-  denominators; never present these as same-source incremental percentages.
-- Final suite: 914 per configuration, zero failures. Passed/skipped:
-  elevated Desktop 890/24, Core 860/54; basic Desktop 749/165, Core 719/195.
+  follow-up `3442194` 2,641/3,559 (74.21%), 974/1,933 (50.39%);
+  Handoff 1 `5a5d58b` 3,192/3,634 (87.84%), 1,273/1,978 (64.36%). Different
+  code changes denominators; never present these as same-source incremental
+  percentages. The branch summary counts 820 compiler-generated points (185
+  visited); report the explicit branch points as well (1,088/1,158, 93.96%).
+- Suite at `5a5d58b`: 1,310 per configuration, zero failures. Passed/skipped:
+  elevated Desktop 1,286/24, Core 1,255/55; basic Desktop 1,076/234,
+  Core 1,045/265.
 - NUnit skipped ForEach names retain placeholders and parameter tuples,
-  executed names expand them. Strip trailing data tuples and match templates;
-  raw-name intersection or positional alignment is invalid across editions.
-  139 skipped templates have eligible executed counterparts. Inspect input
-  eligibility when an individual data row has a condition of its own.
-- Remaining inventory: 918 points, including 244 in cmdlet-unused classes,
-  112 parameter-getter points, and 562 awaiting finer classification/testing.
-  Preserve raw XML, eligibility CSV, logs, commit identity, and build hashes.
+  executed names expand them; raw-name intersection and positional alignment
+  are invalid. Skip eligibility is checked by row: run the suite once per
+  configuration with Pester PassThru (`Get-DiscoveryRows2.ps1 -Run` in the
+  session evidence) and match skipped with executed rows by file, line,
+  path, name, and data. Discovery alone misses tests that skip themselves
+  while they run, and `ConvertTo-Json` of rich data rows never finishes:
+  write primitives and type names.
+- Remaining inventory: 442 points in 231 methods, classified by rule with
+  evidence (probe, IL scan, source reading); see `Tests/Coverage`. Preserve
+  raw XML, row CSVs, logs, commit identity, and build hashes. The frozen
+  Build rewrites the hash file each time: save the hashes of the measured
+  assemblies (AltCover `__Saved` copies) before any mutation build.
+- Bounded mutations: one script per round on the frozen worktree, with
+  guards that no other mutation of the round can trip (an escape can be an
+  overlap or an equivalent mutant: check before changing a test). Restore
+  the source exactly and rebuild.
+- Red/green matrix, to show afterwards that a guard fails without its fix:
+  build each state of the branch (base, then each fix commit) in its own
+  Release worktree, lay the final `Tests` over it (`git checkout <final> --
+  Tests`), run the guarding files with the focused runner (it sets
+  `$ErrorActionPreference` to `Stop` like the CI wrappers) in all four
+  configurations, and count failed rows per name with their multiplicity (a
+  block whose `BeforeAll` fails lists its data rows under one unexpanded
+  template name). The last state is the control and must have no failure.
+  Keep the logs and a manifest with their hashes, and hash each build: the
+  first red runs of Handoff 1 were deleted and could not be reproduced, and
+  the frozen runner rewrites its hash file at each build.
 
 ## Lab acceptance
 

Tests/Coverage/Quality-Gate-Paths-2026-10-09-Cmdlets.csv

@@ -0,0 +1,37 @@
+"Cmdlet","Class","SequenceVisited","SequenceTotal","SequencePercent","BranchVisited","BranchTotal"
+"Add-NTFSAccess","AddAccess","63","72","87.5","13","37"
+"Add-NTFSAudit","AddAudit","56","74","75.7","15","39"
+"Clear-NTFSAccess","ClearAccess","44","50","88","14","22"
+"Clear-NTFSAudit","ClearAudit","37","51","72.5","13","24"
+"Copy-Item2","CopyItem2","61","65","93.8","21","31"
+"Disable-NTFSAccessInheritance","DisableAccessInheritance","42","49","85.7","11","21"
+"Disable-NTFSAuditInheritance","DisableAuditInheritance","36","49","73.5","11","21"
+"Disable-Privileges","DisablePrivileges","15","16","93.8","5","11"
+"Enable-NTFSAccessInheritance","EnableAccessInheritance","42","49","85.7","11","21"
+"Enable-NTFSAuditInheritance","EnableAuditInheritance","36","49","73.5","11","21"
+"Enable-Privileges","EnablePrivileges","17","20","85","9","14"
+"Get-ChildItem2","GetChildItem2","132","145","91","73","102"
+"Get-DiskSpace","GetDiskSpace","23","24","95.8","6","11"
+"Get-FileHash2","GetFileHash2","50","58","86.2","11","19"
+"Get-Item2","GetItem2","21","22","95.5","6","9"
+"Get-NTFSAccess","GetAccess","52","59","88.1","13","26"
+"Get-NTFSAudit","GetAudit","53","56","94.6","15","28"
+"Get-NTFSEffectiveAccess","GetEffectiveAccess","61","76","80.3","23","36"
+"Get-NTFSHardLink","GetHardLink","34","37","91.9","10","13"
+"Get-NTFSInheritance","GetInheritance","38","47","80.9","13","19"
+"Get-NTFSOrphanedAccess","GetOrphanedAccess","39","46","84.8","10","15"
+"Get-NTFSOrphanedAudit","GetOrphanedAudit","38","41","92.7","12","16"
+"Get-NTFSOwner","GetOwner","32","35","91.4","7","12"
+"Get-NTFSSecurityDescriptor","GetSecurityDescriptor","28","36","77.8","8","13"
+"Get-NTFSSimpleAccess","GetSimpleAccess","60","61","98.4","24","35"
+"Get-Privileges","GetPrivileges","5","5","100","0","2"
+"Move-Item2","MoveItem2","65","69","94.2","23","33"
+"New-NTFSHardLink","NewHardLink","57","58","98.3","19","26"
+"New-NTFSSymbolicLink","NewSymbolicLink","38","39","97.4","12","19"
+"Remove-Item2","RemoveItem2","44","48","91.7","13","23"
+"Remove-NTFSAccess","RemoveAccess","74","77","96.1","15","41"
+"Remove-NTFSAudit","RemoveAudit","60","79","75.9","17","43"
+"Set-NTFSInheritance","SetInheritance","83","88","94.3","34","46"
+"Set-NTFSOwner","SetOwner","40","43","93","13","22"
+"Set-NTFSSecurityDescriptor","SetSecurityDescriptor","54","55","98.2","16","21"
+"Test-Path2","TestPath2","35","41","85.4","14","20"

Tests/Coverage/Quality-Gate-Paths-2026-10-09-Explanations.md

@@ -0,0 +1,796 @@
+# Explanations of the unvisited code, by rule
+
+Generated from the classification of the unvisited methods in the aggregated
+AltCover report of source `5a5d58b`.
+[Quality-Gate-Paths-2026-10-09.md](./Quality-Gate-Paths-2026-10-09.md)
+describes the method and the result; the rows of every method are in the CSV
+file next to it. An explanation closes a path only as far as its evidence
+goes: the evidence line of each rule says whether an executed probe, a static
+scan of the compiled code, or reading the source supports it.
+
+## By category
+
+| Category | Disposition | Methods | Unvisited sequence points | Unvisited explicit branch points |
+| --- | --- | ---: | ---: | ---: |
+| unused by cmdlets | Explained | 60 | 173 | 34 |
+| parameter/API surface | Explained | 103 | 103 | 0 |
+| environment-specific | Explained | 27 | 81 | 18 |
+| defensive | Explained | 33 | 77 | 16 |
+| unused by cmdlets | Open | 8 | 8 | 2 |
+| **Total** | | **231** | **442** | **70** |
+
+## By rule
+
+### ACCESS-GENERIC-CATCH
+
+8 method(s), 32 unvisited sequence point(s), 3 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: ClearAccess, DisableAccessInheritance, EnableAccessInheritance,
+GetAccess, GetInheritance, GetOrphanedAccess, GetSecurityDescriptor,
+OwnerCmdlets.GetOwner.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the last catch (Exception) of the per-item loop,
+taken when the DACL API fails with anything but access denied after the item
+was found. A read or write of the DACL on local NTFS either succeeds or fails
+with access denied (covered), and the probes found no other failure for these
+cmdlets: an unresolvable SID is accepted, a locked file does not matter
+because the security APIs ignore share modes, and a dangling junction is read
+as the link itself. One input does trigger that catch, a deny entry without
+rights, which .NET refuses with an ArgumentException; Add-NTFSAccess,
+Remove-NTFSAccess and Add-NTFSAudit take it and are tested (an Allow entry
+without rights is accepted, because the module adds Synchronize to it). A
+cmdlet that has no rights parameter, such as the read and inheritance cmdlets,
+has no such input. A second trigger exists for the cmdlets that add entries:
+an ACL that is full. In both editions the 1,818th entry that was added to a
+security descriptor in memory, with -SecurityDescriptor, raised an
+OverflowException, "Length of the access control list exceed the allowed
+maximum" (probe p37: unresolvable SIDs with ReadData; 1,816 entries were
+written and read back without an error, and one more added with -Path
+succeeded, so the overflow itself was not run with -Path). By reading the
+source, the -Path loop takes that exception in the same handler as the
+zero-mask case, whereas the -SecurityDescriptor sets have no handler around
+the add, so there the exception ends the cmdlet. It was not turned into a test
+of its own. A volume without ACL support or a corrupt descriptor cannot be
+created safely on the shared host.
+
+Residual risk: Low: one WriteError(exception, id, category, path) and
+continue, the shape that the access-denied and ReadFileError siblings of the
+same loops assert and that the zero-mask tests assert for the cmdlets that add
+and remove entries. The catches of the cmdlets that only read or change
+inheritance have no known trigger. A catch that wraps the write of the result
+is entered also when a later command raises something while it takes the
+object; every catch-all whose try block writes directly passes that exception
+on (a scan of the source finds no exception; it cannot see a write inside a
+helper such as the owner restore of InvokeAsOwner, an accepted limitation),
+and the PipelineControl tests run that part for every cmdlet.
+
+Related tests: Access.Tests and Audit.Tests: a deny or audit entry without
+rights for Add-NTFSAccess, Remove-NTFSAccess and Add-NTFSAudit (AddAceError
+and RemoveAceError, ArgumentException, WriteError, target, continuation,
+nothing written). PathErrors: ReadFileError, ReadSecurityError, denied write
+and ownership retry, each with continuation. PipelineControl.Tests: a break, a
+continue, Select-Object -First, a throw, and an error with -ErrorAction Stop
+after the first object.
+
+### ALLOCATED-MEMORY-FINALIZER
+
+2 method(s), 3 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: AllocatedMemory.
+
+Evidence: reading the source.
+
+Why: AllocatedMemory is internal and used only in a using block of
+GetTokenPrivileges, which disposes it and suppresses the finalizer. The
+finalizer and the branch for a pointer that was released already run only for
+an instance that nobody disposed.
+
+Residual risk: None found.
+
+Related tests: Privileges.Tests: the token handle tests list the privileges
+through it.
+
+### AUDIT-OWNER-RETRY
+
+10 method(s), 47 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: AddAudit, AddAudit/<>c__DisplayClass35_0, ClearAudit,
+ClearAudit/<>c__DisplayClass11_0, DisableAuditInheritance,
+DisableAuditInheritance/<>c__DisplayClass15_0, EnableAuditInheritance,
+EnableAuditInheritance/<>c__DisplayClass15_0, RemoveAudit,
+RemoveAudit/<>c__DisplayClass39_0.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the catch (UnauthorizedAccessException) of an
+audit write, its InvokeAsOwner retry and the closure of that retry. Local NTFS
+never raises that exception for an audit change: as a basic user all seven
+audit cmdlets get an IOException, error 1314 (A required privilege is not
+held), in both editions (probe); with the Security privilege nothing in a DACL
+can deny the privilege-only right, and a loopback administrative share ended
+in no exception for all five either (probe, elevated, EnablePrivileges on and
+off). The retry is the InvokeAsOwner code that the access cmdlets share, so
+its success, failure and RestoreOwnerError paths run there; only the audit
+closure bodies, which repeat the first attempt, are unexecuted.
+
+Residual risk: Low to medium: an audit write that a file server answers with
+access denied runs lines that no instrumented test reaches. The live lab suite
+runs the audit cmdlets over SMB outside the instrumented run.
+
+Related tests: PathErrors (denied write and ownership retry for the access
+cmdlets), FileHash and SecurityDescriptor tests (ownership retry), Audit.Tests
+(privilege missing or disabled).
+
+### AUDIT-READ-DENIED
+
+2 method(s), 6 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: AuditCmdlets.GetOrphanedAudit, GetAudit.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the catch (UnauthorizedAccessException) that
+writes a PermissionDenied ReadSecurityError for an audit read. Without the
+Security privilege Windows answers error 1314, which AlphaFS raises as an
+IOException (probe as a basic user, both editions) and the generic catch of
+the same loop reports as an OpenError; with the privilege, nothing denies the
+read locally. An access-denied answer needs a remote file server.
+
+Residual risk: Low: the same WriteError statement with another category.
+
+Related tests: Audit.Tests: error without the Security privilege, descriptor
+read without audit entries.
+
+### CHILDITEM2-NON-FOLDER
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: GetChildItem2.
+
+Evidence: reading the source.
+
+Why: The else of the test for a DirectoryInfo at the start of WriteFileSystem:
+both callers pass one, ProcessRecord after it returned for a file, and the
+recursion with the folders that EnumerateDirectories returned.
+
+Residual risk: None found.
+
+Related tests: ItemCmdlets.Tests: files, folders, recursion, filters, depth.
+
+### CMDLET-GETTER
+
+103 method(s), 103 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: parameter/API surface. Disposition: Explained.
+
+Classes: AddAccess, AddAudit, ClearAccess, ClearAudit, CopyItem2,
+DisableAccessInheritance, DisableAuditInheritance, DisablePrivileges,
+EnableAccessInheritance, EnableAuditInheritance, EnablePrivileges,
+GetChildItem2, GetDiskSpace, GetEffectiveAccess, GetFileHash2, GetInheritance,
+GetItem2, GetSecurityDescriptor, GetSimpleAccess, MoveItem2, NewHardLink,
+NewSymbolicLink, RemoveAccess, RemoveAudit, RemoveItem2, SetInheritance,
+SetOwner, SetSecurityDescriptor.
+
+Evidence: reading the source.
+
+Why: A one-line getter of a cmdlet parameter. PowerShell binds a parameter
+through its setter and the cmdlet code reads the private field, so no caller
+invokes the getter. It has no logic, so a test that reads it back repeats the
+field assignment and proves no behavior.
+
+Residual risk: None found.
+
+Related tests: Every parameter-set test binds the setters; Help.Tests and
+OutputTypes.Tests read the parameter metadata.
+
+### CODEMEMBERS-NULL-BASE
+
+1 method(s), 1 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: FileSystemCodeMembers.
+
+Evidence: an executed probe.
+
+Why: The second null check tests the base object of the PSObject that the
+first check let through. A PSObject cannot wrap null: new PSObject($null) and
+PSObject.AsPSObject($null) throw PSArgumentNullException in both editions
+(probe), and PowerShell hands a $null argument over as null, which the first
+check covers.
+
+Residual risk: None found.
+
+Related tests: ItemCmdlets.Tests: the Mode of files, of a folder, and of no
+object.
+
+### DISKSPACE-EMPTY-VOLUME
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: GetDiskSpace.
+
+Evidence: reading the source.
+
+Why: The unvisited branch skips a volume that reports zero bytes, such as a
+card reader or an optical drive without media. The host has none, and a test
+cannot attach one without changing the shared machine.
+
+Residual risk: Low: the volume is skipped silently.
+
+Related tests: ItemCmdlets.Tests: volumes with a size, drive letter without a
+volume.
+
+### EFFECTIVE-ACCESS-CATCH
+
+2 method(s), 10 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: GetEffectiveAccess, GetEffectiveAccess/<>c__DisplayClass20_0.
+
+Evidence: reading the source.
+
+Why: EffectiveAccess.GetEffectiveAccess hides every failure of its Authz calls
+in a result with OperationFailed, which the cmdlet turns into
+GetEffectiveAccessError. The catch (Exception) blocks and the InvokeAsOwner
+retry therefore see an exception only from what runs outside those calls: the
+read of the descriptor of the item (EffectiveAccess.cs, the FileSystemInfo
+overload) or the conversion of the account. The only local failure of the
+descriptor read is access denied, which the UnauthorizedAccessException branch
+handles and the tests cover; no other local trigger was found, and the
+unresolved identity, which the conversion accepts, ends in OperationFailed.
+
+Residual risk: Low: a failure of the descriptor read other than access denied,
+such as an I/O error of the volume, would run the unvisited catch, which
+writes one ReadEffectivePermissionError and continues like its tested
+siblings.
+
+Related tests: Access.Tests: unresolved identity for a path and a descriptor,
+remote fallback, privilege warnings.
+
+### ENABLEPRIVILEGES-INIT
+
+1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: EnablePrivileges.
+
+Evidence: reading the source.
+
+Why: The branches that test whether the caller is a script named
+NTFSSecurity.Init.ps1 are run by Privileges.Tests, which writes a script of
+that name and of another name and runs each in a child process. The tests
+check the state of the Backup privilege and the verbose message that only the
+cmdlet writes, because with the setting $true the module enables the
+privileges itself before the cmdlet runs: from the Init script the cmdlet
+enables them for EnablePrivileges $true and does nothing for $false, from
+another script it enables them for both. The script that the module ships
+under that name does not call Enable-Privileges (it adds the types). What
+stays unvisited is the catch that rethrows a ParseException for a malformed
+EnablePrivileges value: the base BeginProcessing casts the same value first
+and fails earlier, and the cmdlet takes no pipeline input, so only a consumer
+of the debug or verbose stream could change the setting between the two calls.
+
+Residual risk: Low: the catch rethrows with a message that names the setting;
+it was not run.
+
+Related tests: Privileges.Tests: Enable-Privileges in the script
+NTFSSecurity.Init.ps1 (three cases), Enable-Privileges and Disable-Privileges.
+
+### FILESECURITY-CONVERSION
+
+2 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Open.
+
+Classes: FileSystemSecurity2.
+
+Evidence: an executed probe.
+
+Why: The implicit conversions from FileSecurity and DirectorySecurity
+construct FileSystemSecurity2 from FileInfo("") and DirectoryInfo(""), so they
+always throw ArgumentException (probe: "Path is a zero-length string"). A test
+of the intended behavior would fail, and a test of the actual behavior would
+cement a defect in an API that no cmdlet uses.
+
+Residual risk: Library users who convert a .NET descriptor get an exception.
+Fix or remove is a maintainer decision.
+
+Related tests: None, on purpose.
+
+### FSSEC2-CONSTRUCTOR-FALLBACK
+
+1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: FileSystemSecurity2.
+
+Evidence: reading the source.
+
+Why: The unvisited points are the last fallback of the constructor with one
+argument: the DACL read alone after the DACL read together with the owner and
+the group failed. The first fallback, without the SACL when the Security
+privilege is missing, runs in the basic configurations. The owner and the
+group need the same READ_CONTROL right as the DACL, so the third read succeeds
+only where a volume or a server answers them differently.
+
+Residual risk: Low: the descriptor that the fallback returns holds the DACL
+only, and the cmdlets that need more report it.
+
+Related tests: SecurityDescriptor.Tests and Audit.Tests: a descriptor read
+without the Security privilege.
+
+### FSSEC2-DRIVE-LETTER-CHARS
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: FileSystemSecurity2.
+
+Evidence: reading the source.
+
+Why: The unvisited branch is a first character that is no letter in front of
+the colon. AlphaFS normalizes the full name, so a name of two characters that
+ends in a colon always begins with a drive letter, in upper or lower case
+(both run); a digit or another character cannot form such a name.
+
+Residual risk: None found.
+
+Related tests: DriveRoot.Tests: the system drive and a mapped drive;
+ObjectApis.Tests: a lowercase drive letter.
+
+### FSSEC2-HASHCODE-NULL
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: FileSystemSecurity2.
+
+Evidence: reading the source.
+
+Why: The zero is for a descriptor without a wrapped .NET descriptor. Both
+constructors set it, because GetSecurity returns a descriptor or throws, and
+the conversions from FileSecurity and DirectorySecurity throw before an object
+exists. Only a derived class that sets the field to null reaches it.
+
+Residual risk: None found.
+
+Related tests: SecurityDescriptor.Tests: equality, hash code, and use as a
+key.
+
+### GENERATED-RESOURCES
+
+6 method(s), 12 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Explained.
+
+Classes: Properties.Resources.
+
+Evidence: reading the source.
+
+Why: The designer-generated resource class of two icons that no code
+references.
+
+Residual risk: None found.
+
+Related tests: None needed.
+
+### HARDLINK-DENIED
+
+1 method(s), 3 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: GetHardLink.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the catch (UnauthorizedAccessException) of the
+hard link enumeration. No local input was found that raises it: with deny
+entries for ReadAttributes, ReadData and ReadPermissions for OWNER RIGHTS and
+for the user, and automatic privileges off, Get-NTFSHardLink still listed the
+names (probe p32, elevated, both editions), and Links.Tests asserts that
+listing while the data of the file cannot be read (Get-Content fails). Whether
+a denial of ReadAttributes or ReadPermissions alone could change that was not
+shown: an elevated session read the permissions despite the deny entries, so
+the test asserts only the refused data. The IOException of a network share,
+(50), is covered.
+
+Residual risk: Low: one WriteError with the PermissionDenied category. If a
+Windows version or a file server refuses the listing, the new test fails and
+this catch is reached.
+
+Related tests: Links.Tests: the names of a file whose read rights are denied,
+error for a file on a network share, for a folder and for a missing path.
+
+### HASH-POLICY-AND-RETRY
+
+2 method(s), 7 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: GetFileHash2, GetFileHash2/<>c__DisplayClass9_0.
+
+Evidence: an executed probe.
+
+Why: Two groups. The second catch around the algorithm check handles an
+algorithm that a FIPS policy refuses; the policy of the host cannot be
+switched in a test. The closing points after InvokeAsOwner run only when the
+hash succeeds after taking ownership: ownership grants READ_CONTROL and
+WRITE_DAC but never data read, so the retry can only fail, which two tests
+assert. Probes looked for a way around that: with the owner changed to the
+user the read still ended in access denied (error 5, plus a RestoreOwnerError
+1307 for an owner that the user cannot set back), and an OWNER RIGHTS deny is
+no way in either, because Windows drops that entry when the owner changes.
+
+Residual risk: Low: the success path after the retry has no local trigger. A
+file server that grants the read to the owner only would run it.
+
+Related tests: FileHash.Tests: unavailable algorithms, unreadable file,
+restore of the previous owner, failed restore.
+
+### IDENTITY-NULL-REFERENCE
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: IdentityReference2.
+
+Evidence: reading the source.
+
+Why: The unvisited branch is an IdentityReference that is neither an NTAccount
+nor a SecurityIdentifier, which only null is: the .NET class has no other
+public subclass. The object then has no SID and every member fails with a
+NullReferenceException. No cmdlet passes null, and a test would cement that
+failure.
+
+Residual risk: Low: a library caller that passes null gets an unusable object.
+
+Related tests: ObjectApis.Tests: identity constructors and their errors.
+
+### INHERITED-FROM-EMPTY-LIST
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: FileSystemAuditRule2.
+
+Evidence: an executed probe.
+
+Why: The access twin is tested: a NULL DACL, which Windows reads as an ACL
+with no entries and .NET reports as one entry for Everyone, runs the branch
+where the list of sources is empty (Access.Tests). The unvisited branch that
+remains is the second operand of getInheritedFrom && inheritedFrom.Count > 0
+in the audit twin. GetInheritedFrom returns one source for each entry of the
+SACL that it reads, also for the fallback text of an unknown parent, and an
+empty list only for a descriptor without a SACL. The loop that holds the
+condition runs over the audit entries of the same SACL, so an empty list means
+that the loop has no entry and does not run, as for every item without a SACL
+(Audit.Tests: the item has no SACL). The setting that turns the lookup off and
+the fallback cover the other outcomes. A probe shows that an integrity label
+in the SACL of a folder is not part of the SACL that the module reads, so the
+sources of the audit entries stay aligned with the entries (probe, both
+editions).
+
+Residual risk: Low: the two lists are aligned by position, which assumes that
+the .NET API returns a rule for every entry of the ACL that Windows names a
+source for; an entry type that it skips would shift the sources. No such entry
+was found on NTFS, and none was tested.
+
+Related tests: Access.Tests: InheritedFrom with the setting on and off, for an
+unknown parent and for a NULL DACL; Audit.Tests: InheritedFrom of audit
+entries and an item without a SACL; ObjectApis.Tests: an empty DACL.
+
+### NATIVE-HANDLES
+
+16 method(s), 34 unvisited sequence point(s), 6 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Explained.
+
+Classes: IntPtrExtensions, SafeAuthzRMHandle, SafeHGlobalHandle,
+SafeTokenHandle.
+
+Evidence: reading the source.
+
+Why: Native memory and handle wrappers. The overloads that the Authz and
+descriptor code use run; the unvisited ones have no caller: further
+AllocHGlobal overloads, InvalidHandle getters, ReleaseHandle for handles that
+the module never creates, and Increment. They wrap Marshal.AllocHGlobal and
+FreeHGlobal, so a test would repeat the BCL.
+
+Residual risk: Low.
+
+Related tests: Effective access tests run the used overloads.
+
+### PRIVILEGE-DISABLE-FAILURE
+
+4 method(s), 10 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: BaseCmdletWithPrivControl.
+
+Evidence: reading the source.
+
+Why: These are the failure branches of disabling a privilege. DisablePrivilege
+reads the current state first and does nothing unless the privilege is
+Enabled, so a privilege that another command disabled, or that the token does
+not hold, never reaches them. They run only when AdjustTokenPrivileges fails
+for an enabled privilege, for example for an invalid token handle; a test
+would have to corrupt the process token.
+
+Residual risk: Low: a failed cleanup is a warning that names the privilege.
+The deferred review "failed privilege-disable retry" stays not reproduced.
+
+Related tests: Privileges.Tests: another command disables a privilege, early
+pipeline stop, token holds only some privileges.
+
+### PRIVILEGE-ENABLER-RACE
+
+1 method(s), 0 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: PrivilegeEnabler.
+
+Evidence: reading the source.
+
+Why: The third operand of the condition, that the adjustment returned
+PrivilegeModified, is false only when another thread enabled the privilege
+between the state check and the adjustment of the same call.
+
+Residual risk: None found.
+
+Related tests: Privileges.Tests: the first and the second enabler, a privilege
+that was enabled before, and a privilege that the token does not hold.
+
+### PRIVILEGECONTROL-DEAD-ELSE
+
+2 method(s), 2 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: PrivilegeControl.
+
+Evidence: reading the source.
+
+Why: The unvisited points are the last else of each method, taken when the
+third read of the privilege state finds none of Disabled, Removed, or Enabled.
+PrivilegeState has exactly these three values and GetPrivilegeState returns
+one of them, so the else can run only when another thread changes the
+privilege between the reads of one call.
+
+Residual risk: None found: the message would be Unknown Error, for a state
+that cannot exist.
+
+Related tests: Privileges.Tests: enabling and disabling a held privilege,
+repeating either, and a privilege that the token does not hold.
+
+### READ-RETRY-CLOSURE
+
+4 method(s), 8 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: GetAccess/<>c__DisplayClass20_0, GetInheritance/<>c__DisplayClass7_0,
+GetOrphanedAccess/<>c__DisplayClass1_0,
+GetSecurityDescriptor/<>c__DisplayClass4_0.
+
+Evidence: reading the source.
+
+Why: The closure re-reads the item inside InvokeAsOwner. InvokeAsOwner reads
+the owner first, which needs the same READ_CONTROL right as the read that
+failed, so the retry stops before the closure runs; the documentation and
+PathErrors assert the resulting ReadSecurityError. A DACL that denies reading
+the DACL but not the owner cannot be built.
+
+Residual risk: None found: the closure repeats the first attempt.
+
+Related tests: PathErrors: An item whose owner may not read its permissions.
+
+### REGISTRY-MODEL
+
+34 method(s), 105 unvisited sequence point(s), 20 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Explained.
+
+Classes: RegistryAccessRule2, RegistryEffectivePermissionEntry,
+RegistryInheritanceInfo, RegistryKeyOpenException,
+RegistryKeySetSecurityException, Win32RegistrySecurity.
+
+Evidence: a static scan of the compiled code.
+
+Why: The registry ACL object model of the original project. No cmdlet accepts
+a registry path and no other class of the four assemblies calls it (static IL
+scan). SetRegistryOwner takes ownership of registry keys, which no test may do
+on the shared host, and the model is not part of the documented module
+surface. Decisions 21 and 22 leave these classes to the maintainer.
+
+Residual risk: Untested and undocumented library surface; a script that calls
+it has no test behind it. Keep or remove is a maintainer decision.
+
+Related tests: None; see the decision.
+
+### RELATIVE-PATH-EMPTY
+
+1 method(s), 1 unvisited sequence point(s), 1 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: BaseCmdlet.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the first branch, which replaces an empty path
+with the current location. Every caller passes a validated value: each -Path
+and -Target parameter of the cmdlets carries ValidateNotNullOrEmpty, which
+rejects an empty value and an empty element of an array in both editions
+(probe), and the mandatory -Destination of Copy-Item2 and Move-Item2 rejects
+an empty string. A cmdlet without -Path passes the current location itself.
+
+Residual risk: None found: only a class derived from the cmdlet base class
+could pass an empty path, and it would get the current location.
+
+Related tests: ItemCmdlets.Tests: Get-Item2 resolves ., .., and relative
+names.
+
+### REMOVEALL-ACCOUNT-FILTER
+
+6 method(s), 6 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Open.
+
+Classes: FileSystemAccessRule2, FileSystemAccessRule2/<>c__DisplayClass36_0,
+FileSystemAccessRule2/<>c__DisplayClass36_1, FileSystemAuditRule2,
+FileSystemAuditRule2/<>c__DisplayClass7_0,
+FileSystemAuditRule2/<>c__DisplayClass7_1.
+
+Evidence: reading the source.
+
+Why: The methods run: the cmdlets call RemoveFileSystemAccessRuleAll and
+RemoveFileSystemAuditRuleAll without an account list. Only the branch for a
+non-null list is unvisited, and no cmdlet reaches it. That branch discards the
+result of the LINQ Where that should filter the rules, so the account list has
+no effect and every explicit entry is removed (the deferred #113 finding); its
+predicate, Count() > 1, would also match no account that appears once, so
+using the result as it stands would remove nothing.
+
+Residual risk: Library users who pass accounts lose all entries. A test of the
+intended behavior would fail; the defect stays with the maintainer (Decision
+16 and #113).
+
+Related tests: None for the account list, on purpose; the cmdlets that call
+the methods without one are tested.
+
+### TESTPATH-DEAD-CATCH
+
+1 method(s), 6 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: TestPath2.
+
+Evidence: an executed probe.
+
+Why: The catch (FileNotFoundException) is dead: TryGetFileSystemInfo2 returns
+false for a missing item and never throws it. The catch
+(NotSupportedException) was not reproduced with a colon, wildcard, device,
+long or trailing-dot path in either edition (probes); the ArgumentException of
+Windows PowerShell for illegal characters is covered.
+
+Residual risk: Low: both branches write $false or an error for a path that
+cannot exist.
+
+Related tests: ItemCmdlets.Tests: Test-Path2 with illegal characters and the
+debug message.
+
+### TOKEN-NATIVE-FAILURE
+
+6 method(s), 11 unvisited sequence point(s), 10 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: AccessTokenHandle, Privileges, ProcessHandle.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the branches that throw a Win32Exception when a
+native call fails, and the branches for a size query that succeeds, which it
+never does. They are OpenProcessToken in the constructor of AccessTokenHandle
+(internal; the token of an exited process still opens, probe), CloseHandle in
+ReleaseHandle (ProcessHandle is only created with ownsHandle false, so Windows
+never releases it, and AccessTokenHandle releases a handle that it opened
+itself), LookupPrivilegeValue in GetLuid (the names come from a fixed
+dictionary), LookupPrivilegeName in GetPrivilegeName (the LUIDs come from the
+token), and the second GetTokenInformation call after the size query. A test
+would have to corrupt the token handle of the process or run on a Windows
+version that lacks a privilege. The failures that a caller can cause, a handle
+without the right to query or to adjust privileges, run in the Privileges
+tests.
+
+Residual risk: Low: each branch throws the Win32Exception of the failed call,
+the shape that the covered branches assert.
+
+Related tests: Privileges.Tests: a handle that may only query cannot enable a
+privilege, and a handle that may only adjust cannot be queried.
+
+### UNUSED-CMDLET-HELPER
+
+2 method(s), 8 unvisited sequence point(s), 4 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Explained.
+
+Classes: BaseCmdlet.
+
+Evidence: a static scan of the compiled code.
+
+Why: A protected helper or an empty override without a caller in the four
+assemblies (static IL scan): the System.IO variant of
+BaseCmdlet.GetFileSystemInfo, which every cmdlet replaces with
+GetFileSystemInfo2, and the empty BaseCmdlet.ProcessRecord that every cmdlet
+overrides. Neither can be called from a test without a running cmdlet that
+derives from the class, and they stay until the maintainer decides about
+unused classes (Decisions 21 and 22). The scan misses generic instantiations:
+it called the Extensions.ForEach and GetParent helpers unused although cmdlets
+call them, so they are tested directly now (ObjectApis.Tests) and no longer
+listed here.
+
+Residual risk: Low: not reachable from a cmdlet.
+
+Related tests: None needed; ObjectApis.Tests runs the public Extensions
+helpers.
+
+### WIN32-AUTHZ-FAILURE
+
+4 method(s), 5 unvisited sequence point(s), 5 unvisited explicit
+branch point(s). Category: environment-specific. Disposition: Explained.
+
+Classes: Win32.
+
+Evidence: an executed probe.
+
+Why: The unvisited points are the failures of the Authz calls other than the
+two answers that the module expects of an unreachable computer, RPC server
+unavailable and endpoint not registered, and the failure of the local resource
+manager that follows. Every server name that a test can give, an empty one,
+one with a space, backslashes, a colon, a bracket, 300 characters, malformed
+and well-formed addresses, ends in one of the two expected answers (probe),
+and the local resource manager does not fail. A test would need a remote
+computer that answers with another error.
+
+Residual risk: Low: the cmdlet reports the exception as
+GetEffectiveAccessError, the shape that the covered unresolved-identity case
+asserts.
+
+Related tests: Access.Tests: an unresolved identity, a computer that cannot be
+reached, names of this computer, an empty name.
+
+### WIN32-LOCAL-NAME-LOOKUP
+
+1 method(s), 2 unvisited sequence point(s), 0 unvisited explicit
+branch point(s). Category: defensive. Disposition: Explained.
+
+Classes: Win32.
+
+Evidence: reading the source.
+
+Why: The unvisited points are the catch of a NetworkInformationException from
+the lookup of the host and domain name of this computer, which returns false.
+The lookup reads the local TCP/IP parameters, which this host has, and a test
+cannot remove them.
+
+Residual risk: None found: the name is then treated as another computer, with
+the warning.
+
+Related tests: Access.Tests: names of this computer, a computer that cannot be
+reached, an empty name.
+
+### WIN32-RAW-DESCRIPTOR
+
+2 method(s), 14 unvisited sequence point(s), 2 unvisited explicit
+branch point(s). Category: unused by cmdlets. Disposition: Explained.
+
+Classes: Win32.
+
+Evidence: a static scan of the compiled code.
+
+Why: Win32 is an internal class. GetRawSecurityDescriptor is private and has
+no caller, and the only caller of GetByteSecurityDescriptor is
+GetRawSecurityDescriptor (static IL scan). They read a descriptor from a
+handle, which the module does through AlphaFS.
+
+Residual risk: None found: dead code. Removing it is a maintainer decision
+(Decisions 21 and 22).
+
+Related tests: None needed.

Tests/Coverage/Quality-Gate-Paths-2026-10-09-Methods.csv

@@ -0,0 +1,232 @@
+"Assembly","Class","Method","Source","UnvisitedLines","UnvisitedSequence","UnvisitedBranches","ReachableFromCmdletInIL","CmdletCallPath","RuleId","Category","Disposition"
+"NTFSSecurity","NTFSSecurity.ClearAccess","ProcessRecord()","NTFSSecurity\AccessCmdlets\ClearAccess.cs","92,94,95","3","0","True","ClearAccess::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAccessInheritance","ProcessRecord()","NTFSSecurity\InheritanceCmdlets\DisableAccessInheritance.cs","97,99,100","3","0","True","DisableAccessInheritance::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAccessInheritance","ProcessRecord()","NTFSSecurity\InheritanceCmdlets\EnableAccessInheritance.cs","97,99,100","3","0","True","EnableAccessInheritance::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetAccess","ProcessRecord()","NTFSSecurity\AccessCmdlets\GetAccess.cs","112,118,119,121,122","5","0","True","GetAccess::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetInheritance","ProcessRecord()","NTFSSecurity\InheritanceCmdlets\GetInheritance.cs","80,86,87,89,90,107","5","1","True","GetInheritance::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetOrphanedAccess","ProcessRecord()","NTFSSecurity\AccessCmdlets\GetOrphanedAccess.cs","55,62,63,65,66","5","0","True","GetOrphanedAccess::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetSecurityDescriptor","ProcessRecord()","NTFSSecurity\SecurityDescriptorCmdlets\GetSecurityDescriptor.cs","64,67,69,75,78,83,84","5","2","True","GetSecurityDescriptor::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.OwnerCmdlets.GetOwner","ProcessRecord()","NTFSSecurity\OwnerCmdlets\GetOwner.cs","72,74,75","3","0","True","GetOwner::ProcessRecord","ACCESS-GENERIC-CATCH","defensive","Explained"
+"ProcessPrivileges","ProcessPrivileges.AllocatedMemory","Finalize()","ProcessPrivileges\AllocatedMemory.cs","28,29","3","0","False","","ALLOCATED-MEMORY-FINALIZER","defensive","Explained"
+"ProcessPrivileges","ProcessPrivileges.AllocatedMemory","InternalDispose()","ProcessPrivileges\AllocatedMemory.cs","47","0","1","False","","ALLOCATED-MEMORY-FINALIZER","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","ProcessRecord()","NTFSSecurity\AuditCmdlets\AddAudit.cs","137,141,145,146,148,149,151","7","0","True","AddAudit::ProcessRecord","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit/<>c__DisplayClass35_0","<ProcessRecord>b__0()","NTFSSecurity\AuditCmdlets\AddAudit.cs","143,144","2","0","True","AddAudit::ProcessRecord > AddAudit/<>c__DisplayClass35_0::<ProcessRecord>b__0","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAudit","ProcessRecord()","NTFSSecurity\AuditCmdlets\ClearAudit.cs","76,80,86,87,89,90,91","7","0","True","ClearAudit::ProcessRecord","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAudit/<>c__DisplayClass11_0","<ProcessRecord>b__0()","NTFSSecurity\AuditCmdlets\ClearAudit.cs","82,83,84,85","4","2","True","ClearAudit::ProcessRecord > ClearAudit/<>c__DisplayClass11_0::<ProcessRecord>b__0","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance","ProcessRecord()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","88,92,96,97,99,100,102","7","0","True","DisableAuditInheritance::ProcessRecord","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance/<>c__DisplayClass15_0","<ProcessRecord>b__0()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","94,95","2","0","True","DisableAuditInheritance::ProcessRecord > DisableAuditInheritance/<>c__DisplayClass15_0::<ProcessRecord>b__0","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance","ProcessRecord()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","87,91,95,96,98,99,101","7","0","True","EnableAuditInheritance::ProcessRecord","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance/<>c__DisplayClass15_0","<ProcessRecord>b__0()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","93,94","2","0","True","EnableAuditInheritance::ProcessRecord > EnableAuditInheritance/<>c__DisplayClass15_0::<ProcessRecord>b__0","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","ProcessRecord()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","153,157,161,162,164,165,167","7","0","True","RemoveAudit::ProcessRecord","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit/<>c__DisplayClass39_0","<ProcessRecord>b__0()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","159,160","2","0","True","RemoveAudit::ProcessRecord > RemoveAudit/<>c__DisplayClass39_0::<ProcessRecord>b__0","AUDIT-OWNER-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.AuditCmdlets.GetOrphanedAudit","ProcessRecord()","NTFSSecurity\AuditCmdlets\Get-OrphanedAudit.cs","56,58,59","3","0","True","GetOrphanedAudit::ProcessRecord","AUDIT-READ-DENIED","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.GetAudit","ProcessRecord()","NTFSSecurity\AuditCmdlets\GetAudit.cs","104,107,108","3","0","True","GetAudit::ProcessRecord","AUDIT-READ-DENIED","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","WriteFileSystem(FileSystemInfo,Int32)","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","205","0","1","True","GetChildItem2::ProcessRecord > GetChildItem2::WriteFileSystem","CHILDITEM2-NON-FOLDER","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_AccessRights()","NTFSSecurity\AccessCmdlets\AddAccess.cs","62","1","0","True","AddAccess::get_AccessRights","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_AccessType()","NTFSSecurity\AccessCmdlets\AddAccess.cs","70","1","0","True","AddAccess::get_AccessType","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_Account()","NTFSSecurity\AccessCmdlets\AddAccess.cs","54","1","0","True","AddAccess::get_Account","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_AppliesTo()","NTFSSecurity\AccessCmdlets\AddAccess.cs","95","1","0","True","AddAccess::get_AppliesTo","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_InheritanceFlags()","NTFSSecurity\AccessCmdlets\AddAccess.cs","78","1","0","True","AddAccess::get_InheritanceFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_PassThru()","NTFSSecurity\AccessCmdlets\AddAccess.cs","102","1","0","True","AddAccess::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_Path()","NTFSSecurity\AccessCmdlets\AddAccess.cs","29","1","0","True","AddAccess::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_PropagationFlags()","NTFSSecurity\AccessCmdlets\AddAccess.cs","86","1","0","True","AddAccess::get_PropagationFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAccess","get_SecurityDescriptor()","NTFSSecurity\AccessCmdlets\AddAccess.cs","42","1","0","True","AddAccess::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_AccessRights()","NTFSSecurity\AuditCmdlets\AddAudit.cs","62","1","0","True","AddAudit::get_AccessRights","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_Account()","NTFSSecurity\AuditCmdlets\AddAudit.cs","54","1","0","True","AddAudit::get_Account","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_AppliesTo()","NTFSSecurity\AuditCmdlets\AddAudit.cs","94","1","0","True","AddAudit::get_AppliesTo","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_AuditFlags()","NTFSSecurity\AuditCmdlets\AddAudit.cs","69","1","0","True","AddAudit::get_AuditFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_InheritanceFlags()","NTFSSecurity\AuditCmdlets\AddAudit.cs","77","1","0","True","AddAudit::get_InheritanceFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_PassThru()","NTFSSecurity\AuditCmdlets\AddAudit.cs","101","1","0","True","AddAudit::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_Path()","NTFSSecurity\AuditCmdlets\AddAudit.cs","29","1","0","True","AddAudit::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_PropagationFlags()","NTFSSecurity\AuditCmdlets\AddAudit.cs","85","1","0","True","AddAudit::get_PropagationFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.AddAudit","get_SecurityDescriptor()","NTFSSecurity\AuditCmdlets\AddAudit.cs","42","1","0","True","AddAudit::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAccess","get_DisableInheritance()","NTFSSecurity\AccessCmdlets\ClearAccess.cs","42","1","0","True","ClearAccess::get_DisableInheritance","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAccess","get_Path()","NTFSSecurity\AccessCmdlets\ClearAccess.cs","19","1","0","True","ClearAccess::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAccess","get_SecurityDescriptor()","NTFSSecurity\AccessCmdlets\ClearAccess.cs","31","1","0","True","ClearAccess::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAudit","get_DisableInheritance()","NTFSSecurity\AuditCmdlets\ClearAudit.cs","42","1","0","True","ClearAudit::get_DisableInheritance","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAudit","get_Path()","NTFSSecurity\AuditCmdlets\ClearAudit.cs","19","1","0","True","ClearAudit::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.ClearAudit","get_SecurityDescriptor()","NTFSSecurity\AuditCmdlets\ClearAudit.cs","31","1","0","True","ClearAudit::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.CopyItem2","get_Destination()","NTFSSecurity\ItemCmdlets\CopyItem2.cs","33","1","0","True","CopyItem2::get_Destination","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.CopyItem2","get_Force()","NTFSSecurity\ItemCmdlets\CopyItem2.cs","40","1","0","True","CopyItem2::get_Force","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.CopyItem2","get_PassThru()","NTFSSecurity\ItemCmdlets\CopyItem2.cs","47","1","0","True","CopyItem2::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.CopyItem2","get_Path()","NTFSSecurity\ItemCmdlets\CopyItem2.cs","21","1","0","True","CopyItem2::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAccessInheritance","get_PassThru()","NTFSSecurity\InheritanceCmdlets\DisableAccessInheritance.cs","51","1","0","True","DisableAccessInheritance::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAccessInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\DisableAccessInheritance.cs","21","1","0","True","DisableAccessInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAccessInheritance","get_RemoveInheritedAccessRules()","NTFSSecurity\InheritanceCmdlets\DisableAccessInheritance.cs","44","1","0","True","DisableAccessInheritance::get_RemoveInheritedAccessRules","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAccessInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\DisableAccessInheritance.cs","33","1","0","True","DisableAccessInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance","get_PassThru()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","57","1","0","True","DisableAuditInheritance::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","22","1","0","True","DisableAuditInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance","get_RemoveInheritedAuditRules()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","50","1","0","True","DisableAuditInheritance::get_RemoveInheritedAuditRules","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisableAuditInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\DisableAuditInheritance.cs","34","1","0","True","DisableAuditInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.DisablePrivileges","get_PassThru()","NTFSSecurity\OtherCmdlets.cs","83","1","0","True","DisablePrivileges::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAccessInheritance","get_PassThru()","NTFSSecurity\InheritanceCmdlets\EnableAccessInheritance.cs","44","1","0","True","EnableAccessInheritance::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAccessInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\EnableAccessInheritance.cs","21","1","0","True","EnableAccessInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAccessInheritance","get_RemoveExplicitAccessRules()","NTFSSecurity\InheritanceCmdlets\EnableAccessInheritance.cs","51","1","0","True","EnableAccessInheritance::get_RemoveExplicitAccessRules","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAccessInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\EnableAccessInheritance.cs","33","1","0","True","EnableAccessInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance","get_PassThru()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","44","1","0","True","EnableAuditInheritance::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","21","1","0","True","EnableAuditInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance","get_RemoveExplicitAuditRules()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","56","1","0","True","EnableAuditInheritance::get_RemoveExplicitAuditRules","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnableAuditInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\EnableAuditInheritance.cs","33","1","0","True","EnableAuditInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.EnablePrivileges","get_PassThru()","NTFSSecurity\OtherCmdlets.cs","21","1","0","True","EnablePrivileges::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Attributes()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","79","1","0","True","GetChildItem2::get_Attributes","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Depth()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","128","1","0","True","GetChildItem2::get_Depth","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Directory()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","65","1","0","True","GetChildItem2::get_Directory","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_File()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","72","1","0","True","GetChildItem2::get_File","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Filter()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","51","1","0","True","GetChildItem2::get_Filter","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Force()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","107","1","0","True","GetChildItem2::get_Force","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Hidden()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","86","1","0","True","GetChildItem2::get_Hidden","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Path()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","39","1","0","True","GetChildItem2::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_ReadOnly()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","100","1","0","True","GetChildItem2::get_ReadOnly","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_Recurse()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","58","1","0","True","GetChildItem2::get_Recurse","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_SkipMountPoints()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","114","1","0","True","GetChildItem2::get_SkipMountPoints","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_SkipSymbolicLinks()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","121","1","0","True","GetChildItem2::get_SkipSymbolicLinks","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetChildItem2","get_System()","NTFSSecurity\ItemCmdlets\GetChildItem2.cs","93","1","0","True","GetChildItem2::get_System","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetDiskSpace","get_DriveLetter()","NTFSSecurity\ItemCmdlets\GetDiskSpace.cs","18","1","0","True","GetDiskSpace::get_DriveLetter","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","get_Account()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","51","1","0","True","GetEffectiveAccess::get_Account","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","get_ExcludeNoneAccessEntries()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","65","1","0","True","GetEffectiveAccess::get_ExcludeNoneAccessEntries","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","get_Path()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","26","1","0","True","GetEffectiveAccess::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","get_SecurityDescriptor()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","38","1","0","True","GetEffectiveAccess::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","get_ServerName()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","58","1","0","True","GetEffectiveAccess::get_ServerName","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetFileHash2","get_Algorithm()","NTFSSecurity\MiscCmdlets\GetFileHash2.cs","33","1","0","True","GetFileHash2::get_Algorithm","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\GetInheritance.cs","19","1","0","True","GetInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\GetInheritance.cs","31","1","0","True","GetInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetItem2","get_Path()","NTFSSecurity\ItemCmdlets\GetItem2.cs","19","1","0","True","GetItem2::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetSecurityDescriptor","get_Path()","NTFSSecurity\SecurityDescriptorCmdlets\GetSecurityDescriptor.cs","18","1","0","True","GetSecurityDescriptor::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.GetSimpleAccess","get_IncludeRootFolder()","NTFSSecurity\SimpleAccessCmdlets\SimpleAccessCmdlets.cs","24","1","0","True","GetSimpleAccess::get_IncludeRootFolder","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.MoveItem2","get_Destination()","NTFSSecurity\ItemCmdlets\MoveItem2.cs","33","1","0","True","MoveItem2::get_Destination","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.MoveItem2","get_Force()","NTFSSecurity\ItemCmdlets\MoveItem2.cs","40","1","0","True","MoveItem2::get_Force","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.MoveItem2","get_PassThru()","NTFSSecurity\ItemCmdlets\MoveItem2.cs","47","1","0","True","MoveItem2::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.MoveItem2","get_Path()","NTFSSecurity\ItemCmdlets\MoveItem2.cs","21","1","0","True","MoveItem2::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.NewHardLink","get_PassThru()","NTFSSecurity\LinkCmdlets\NewHardLink.cs","47","1","0","True","NewHardLink::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.NewSymbolicLink","get_PassThru()","NTFSSecurity\LinkCmdlets\NewSymbolicLink.cs","45","1","0","True","NewSymbolicLink::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAccess","get_AppliesTo()","NTFSSecurity\AccessCmdlets\RemoveAccess.cs","96","1","0","True","RemoveAccess::get_AppliesTo","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAccess","get_PassThru()","NTFSSecurity\AccessCmdlets\RemoveAccess.cs","113","1","0","True","RemoveAccess::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAccess","get_RemoveSpecific()","NTFSSecurity\AccessCmdlets\RemoveAccess.cs","106","1","0","True","RemoveAccess::get_RemoveSpecific","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_AccessRights()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","63","1","0","True","RemoveAudit::get_AccessRights","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_Account()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","55","1","0","True","RemoveAudit::get_Account","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_AppliesTo()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","95","1","0","True","RemoveAudit::get_AppliesTo","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_AuditFlags()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","70","1","0","True","RemoveAudit::get_AuditFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_InheritanceFlags()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","78","1","0","True","RemoveAudit::get_InheritanceFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_PassThru()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","112","1","0","True","RemoveAudit::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_Path()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","30","1","0","True","RemoveAudit::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_PropagationFlags()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","86","1","0","True","RemoveAudit::get_PropagationFlags","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_RemoveSpecific()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","105","1","0","True","RemoveAudit::get_RemoveSpecific","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveAudit","get_SecurityDescriptor()","NTFSSecurity\AuditCmdlets\RemoveAudit.cs","43","1","0","True","RemoveAudit::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveItem2","get_Force()","NTFSSecurity\ItemCmdlets\RemoveItem2.cs","32","1","0","True","RemoveItem2::get_Force","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveItem2","get_PassThru()","NTFSSecurity\ItemCmdlets\RemoveItem2.cs","48","1","0","True","RemoveItem2::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveItem2","get_Path()","NTFSSecurity\ItemCmdlets\RemoveItem2.cs","21","1","0","True","RemoveItem2::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.RemoveItem2","get_Recurse()","NTFSSecurity\ItemCmdlets\RemoveItem2.cs","39","1","0","True","RemoveItem2::get_Recurse","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetInheritance","get_AccessInheritanceEnabled()","NTFSSecurity\InheritanceCmdlets\SetInheritance.cs","45","1","0","True","SetInheritance::get_AccessInheritanceEnabled","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetInheritance","get_AuditInheritanceEnabled()","NTFSSecurity\InheritanceCmdlets\SetInheritance.cs","52","1","0","True","SetInheritance::get_AuditInheritanceEnabled","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetInheritance","get_PassThru()","NTFSSecurity\InheritanceCmdlets\SetInheritance.cs","59","1","0","True","SetInheritance::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetInheritance","get_Path()","NTFSSecurity\InheritanceCmdlets\SetInheritance.cs","22","1","0","True","SetInheritance::get_Path","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetInheritance","get_SecurityDescriptor()","NTFSSecurity\InheritanceCmdlets\SetInheritance.cs","34","1","0","True","SetInheritance::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetOwner","get_Account()","NTFSSecurity\OwnerCmdlets\SetOwner.cs","44","1","0","True","SetOwner::get_Account","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetOwner","get_PassThru()","NTFSSecurity\OwnerCmdlets\SetOwner.cs","51","1","0","True","SetOwner::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetOwner","get_SecurityDescriptor()","NTFSSecurity\OwnerCmdlets\SetOwner.cs","33","1","0","True","SetOwner::get_SecurityDescriptor","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.SetSecurityDescriptor","get_PassThru()","NTFSSecurity\SecurityDescriptorCmdlets\SetSecurityDescriptor.cs","28","1","0","True","SetSecurityDescriptor::get_PassThru","CMDLET-GETTER","parameter/API surface","Explained"
+"NTFSSecurity","NTFSSecurity.FileSystemCodeMembers","Mode(Management.Automation.PSObject)","NTFSSecurity\CodeMembers.cs","15,17","1","1","False","","CODEMEMBERS-NULL-BASE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetDiskSpace","ProcessRecord()","NTFSSecurity\ItemCmdlets\GetDiskSpace.cs","52","0","1","True","GetDiskSpace::ProcessRecord","DISKSPACE-EMPTY-VOLUME","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess","ProcessRecord()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","99,101,102,141,147,148,150,151","8","0","True","GetEffectiveAccess::ProcessRecord","EFFECTIVE-ACCESS-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetEffectiveAccess/<>c__DisplayClass20_0","<ProcessRecord>b__0()","NTFSSecurity\AccessCmdlets\GetEffectiveAccess.cs","139,140","2","0","True","GetEffectiveAccess::ProcessRecord > GetEffectiveAccess/<>c__DisplayClass20_0::<ProcessRecord>b__0","EFFECTIVE-ACCESS-CATCH","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.EnablePrivileges","ProcessRecord()","NTFSSecurity\OtherCmdlets.cs","39,41","2","0","True","EnablePrivileges::ProcessRecord","ENABLEPRIVILEGES-INIT","defensive","Explained"
+"Security2","Security2.FileSystemSecurity2","op_Implicit(DirectorySecurity)","Security2\FileSystem\FileSystemSecurity2.cs","254","1","0","False","","FILESECURITY-CONVERSION","unused by cmdlets","Open"
+"Security2","Security2.FileSystemSecurity2","op_Implicit(FileSecurity)","Security2\FileSystem\FileSystemSecurity2.cs","245","1","0","False","","FILESECURITY-CONVERSION","unused by cmdlets","Open"
+"Security2","Security2.FileSystemSecurity2",".ctor(FileSystemInfo)","Security2\FileSystem\FileSystemSecurity2.cs","62,63","2","0","True","GetSecurityDescriptor::ProcessRecord > FileSystemSecurity2::.ctor","FSSEC2-CONSTRUCTOR-FALLBACK","environment-specific","Explained"
+"Security2","Security2.FileSystemSecurity2","TryGetDriveRoot(FileSystemInfo,String&)","Security2\FileSystem\FileSystemSecurity2.cs","122","0","1","True","DisableAccessInheritance::ProcessRecord > FileSystemInheritanceInfo::GetFileSystemInheritanceInfo > FileSystemSecurity2::GetSecurity > FileSystemSecurity2::TryGetDriveRoot","FSSEC2-DRIVE-LETTER-CHARS","defensive","Explained"
+"Security2","Security2.FileSystemSecurity2","GetHashCode()","Security2\FileSystem\FileSystemSecurity2.cs","267","0","1","False","","FSSEC2-HASHCODE-NULL","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources",".ctor()","NTFSSecurity\Properties\Resources.Designer.cs","32,33","2","0","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources","get_ContainerIcon()","NTFSSecurity\Properties\Resources.Designer.cs","68","1","0","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources","get_Culture()","NTFSSecurity\Properties\Resources.Designer.cs","56","1","0","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources","get_IconContainer()","NTFSSecurity\Properties\Resources.Designer.cs","77,78","2","0","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources","get_ResourceManager()","NTFSSecurity\Properties\Resources.Designer.cs","41,42,43,45","4","2","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.Properties.Resources","set_Culture(Globalization.CultureInfo)","NTFSSecurity\Properties\Resources.Designer.cs","59,60","2","0","False","","GENERATED-RESOURCES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.GetHardLink","ProcessRecord()","NTFSSecurity\LinkCmdlets\GetHardLink.cs","77,79,80","3","0","True","GetHardLink::ProcessRecord","HARDLINK-DENIED","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.GetFileHash2","ProcessRecord()","NTFSSecurity\MiscCmdlets\GetFileHash2.cs","51,52,55,56,103,109","6","0","True","GetFileHash2::ProcessRecord","HASH-POLICY-AND-RETRY","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.GetFileHash2/<>c__DisplayClass9_0","<ProcessRecord>b__0()","NTFSSecurity\MiscCmdlets\GetFileHash2.cs","102","1","0","True","GetFileHash2::ProcessRecord > GetFileHash2/<>c__DisplayClass9_0::<ProcessRecord>b__0","HASH-POLICY-AND-RETRY","environment-specific","Explained"
+"Security2","Security2.IdentityReference2",".ctor(Security.Principal.IdentityReference)","Security2\IdentityReference2.cs","49","0","1","True","AddAccess::ProcessRecord > BaseCmdlet::InvokeAsOwner > IdentityReference2::op_Implicit > IdentityReference2::.ctor","IDENTITY-NULL-REFERENCE","defensive","Explained"
+"Security2","Security2.FileSystemAuditRule2","GetFileSystemAuditRules(FileSystemSecurity2,Boolean,Boolean,Boolean)","Security2\FileSystem\FileSystemAuditRule2 Class\FileSystemAuditRule2.GetFileSystemAuditRules.cs","44","0","1","True","AddAudit::ProcessRecord > FileSystemAuditRule2::GetFileSystemAuditRules","INHERITED-FROM-EMPTY-LIST","defensive","Explained"
+"Security2","Security2.IntPtrExtensions","Increment(IntPtr)","Security2\Extensions.cs","15","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeAuthzRMHandle",".ctor(IntPtr)","Security2\Win32\SafeHandleEx.cs","299,301,302","3","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeAuthzRMHandle","get_InvalidHandle()","Security2\Win32\SafeHandleEx.cs","309","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle",".ctor(IntPtr)","Security2\Win32\SafeHandleEx.cs","31,33,34","3","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AddSubReference(IEnumerable`1<SafeHGlobalHandle>)","Security2\Win32\SafeHandleEx.cs","60,62,65,66","4","2","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AllocHGlobal(ICollection`1<T>)","Security2\Win32\SafeHandleEx.cs","109","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AllocHGlobal(Int32,IEnumerable`1<T>,Int32)","Security2\Win32\SafeHandleEx.cs","130,132,133,135,136,139","8","2","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AllocHGlobal(Int32)","Security2\Win32\SafeHandleEx.cs","184,186","1","1","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AllocHGlobal(IntPtr[])","Security2\Win32\SafeHandleEx.cs","77,79,81","3","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","AllocHGlobal(String)","Security2\Win32\SafeHandleEx.cs","150","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","Dispose()","Security2\Win32\SafeHandleEx.cs","169","0","1","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeHGlobalHandle","get_InvalidHandle()","Security2\Win32\SafeHandleEx.cs","45","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeTokenHandle",".ctor()","Security2\Win32\SafeHandleEx.cs","243","2","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeTokenHandle",".ctor(IntPtr)","Security2\Win32\SafeHandleEx.cs","247,249,250","3","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeTokenHandle","get_InvalidHandle()","Security2\Win32\SafeHandleEx.cs","256","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"Security2","Security2.SafeTokenHandle","ReleaseHandle()","Security2\Win32\SafeHandleEx.cs","266","1","0","False","","NATIVE-HANDLES","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdletWithPrivControl","DisableEnabledPrivileges(Dictionary`2<String,Exception>)","NTFSSecurity\BaseCmdlets.cs","422,424,425","3","0","True","BaseCmdletWithPrivControl::Dispose > BaseCmdletWithPrivControl::DisableEnabledPrivileges","PRIVILEGE-DISABLE-FAILURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdletWithPrivControl","DisableFileSystemPrivileges()","NTFSSecurity\BaseCmdlets.cs","544,545","1","1","True","DisablePrivileges::ProcessRecord > BaseCmdletWithPrivControl::DisableFileSystemPrivileges","PRIVILEGE-DISABLE-FAILURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdletWithPrivControl","EndProcessing()","NTFSSecurity\BaseCmdlets.cs","389,391,392","3","1","True","BaseCmdletWithPrivControl::EndProcessing","PRIVILEGE-DISABLE-FAILURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdletWithPrivControl","TryDisablePrivilege(ProcessPrivileges.Privilege)","NTFSSecurity\BaseCmdlets.cs","490,492,493","3","0","True","DisablePrivileges::ProcessRecord > BaseCmdletWithPrivControl::DisableFileSystemPrivileges > BaseCmdletWithPrivControl::TryDisablePrivilege","PRIVILEGE-DISABLE-FAILURE","defensive","Explained"
+"ProcessPrivileges","ProcessPrivileges.PrivilegeEnabler","EnablePrivilege(ProcessPrivileges.Privilege)","ProcessPrivileges\PrivilegeEnabler.cs","172","0","1","False","","PRIVILEGE-ENABLER-RACE","defensive","Explained"
+"PrivilegeControl","Security2.PrivilegeControl","DisablePrivilege(ProcessPrivileges.Privilege)","PrivilegeControl\PrivilegeControl.cs","61,67","1","1","True","BaseCmdletWithPrivControl::Dispose > BaseCmdletWithPrivControl::DisableEnabledPrivileges > BaseCmdletWithPrivControl::DisablePrivilege > PrivilegeControl::DisablePrivilege","PRIVILEGECONTROL-DEAD-ELSE","defensive","Explained"
+"PrivilegeControl","Security2.PrivilegeControl","EnablePrivilege(ProcessPrivileges.Privilege)","PrivilegeControl\PrivilegeControl.cs","40,46","1","1","True","BaseCmdletWithPrivControl::BeginProcessing > BaseCmdletWithPrivControl::EnableFileSystemPrivileges > BaseCmdletWithPrivControl::TryEnablePrivilege > BaseCmdletWithPrivControl::EnablePrivilege > PrivilegeControl::EnablePrivilege","PRIVILEGECONTROL-DEAD-ELSE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetAccess/<>c__DisplayClass20_0","<ProcessRecord>b__0()","NTFSSecurity\AccessCmdlets\GetAccess.cs","110,111","2","0","True","GetAccess::ProcessRecord > GetAccess/<>c__DisplayClass20_0::<ProcessRecord>b__0","READ-RETRY-CLOSURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetInheritance/<>c__DisplayClass7_0","<ProcessRecord>b__0()","NTFSSecurity\InheritanceCmdlets\GetInheritance.cs","78,79","2","0","True","GetInheritance::ProcessRecord > GetInheritance/<>c__DisplayClass7_0::<ProcessRecord>b__0","READ-RETRY-CLOSURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetOrphanedAccess/<>c__DisplayClass1_0","<ProcessRecord>b__0()","NTFSSecurity\AccessCmdlets\GetOrphanedAccess.cs","53,54","2","0","True","GetOrphanedAccess::ProcessRecord > GetOrphanedAccess/<>c__DisplayClass1_0::<ProcessRecord>b__0","READ-RETRY-CLOSURE","defensive","Explained"
+"NTFSSecurity","NTFSSecurity.GetSecurityDescriptor/<>c__DisplayClass4_0","<ProcessRecord>b__0()","NTFSSecurity\SecurityDescriptorCmdlets\GetSecurityDescriptor.cs","62,63","2","0","True","GetSecurityDescriptor::ProcessRecord > GetSecurityDescriptor/<>c__DisplayClass4_0::<ProcessRecord>b__0","READ-RETRY-CLOSURE","defensive","Explained"
+"Security2","Security2.RegistryAccessRule2",".ctor(RegistryAccessRule)","Security2\Registry\RegistrySecurity.cs","140,142,143","3","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","Dispose()","Security2\Registry\RegistrySecurity.cs","180","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","Equals(Object)","Security2\Registry\RegistrySecurity.cs","166","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_AccessControlType()","Security2\Registry\RegistrySecurity.cs","146","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_IdentityReference()","Security2\Registry\RegistrySecurity.cs","148","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_InheritanceFlags()","Security2\Registry\RegistrySecurity.cs","149","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_IsInherited()","Security2\Registry\RegistrySecurity.cs","150","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_Name()","Security2\Registry\RegistrySecurity.cs","117,119,121,122,126,131","6","4","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_PropagationFlags()","Security2\Registry\RegistrySecurity.cs","151","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","get_RegistryRights()","Security2\Registry\RegistrySecurity.cs","147","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","GetHashCode()","Security2\Registry\RegistrySecurity.cs","170","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","op_Implicit(RegistryAccessRule)","Security2\Registry\RegistrySecurity.cs","161","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","op_Implicit(RegistryAccessRule2)","Security2\Registry\RegistrySecurity.cs","157","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryAccessRule2","ToString()","Security2\Registry\RegistrySecurity.cs","174","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry",".ctor(IdentityReference2,UInt32,String)","Security2\Registry\RegistrySecurity.cs","252,254,255,256,257,259,261,265,266,268,271","13","4","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry","get_AccessAsString()","Security2\Registry\RegistrySecurity.cs","250","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry","get_AccessMask()","Security2\Registry\RegistrySecurity.cs","224","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry","get_Account()","Security2\Registry\RegistrySecurity.cs","221","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry","get_FullName()","Security2\Registry\RegistrySecurity.cs","227","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryEffectivePermissionEntry","get_Name()","Security2\Registry\RegistrySecurity.cs","230,232,234,235,239,244","6","4","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryInheritanceInfo","get_FullName()","Security2\Registry\RegistrySecurity.cs","191","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryInheritanceInfo","get_Name()","Security2\Registry\RegistrySecurity.cs","196,198,200,201,205,210","6","4","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeyOpenException",".ctor()","Security2\Registry\RegistrySecurity.cs","333,334","2","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeyOpenException",".ctor(Exception,Int64)","Security2\Registry\RegistrySecurity.cs","347,349,350","3","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeyOpenException",".ctor(Exception)","Security2\Registry\RegistrySecurity.cs","337,338","2","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeyOpenException",".ctor(Int64)","Security2\Registry\RegistrySecurity.cs","341,343,344","3","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeyOpenException","get_Win32ErrorCode()","Security2\Registry\RegistrySecurity.cs","330","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeySetSecurityException",".ctor()","Security2\Registry\RegistrySecurity.cs","359,360","2","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeySetSecurityException",".ctor(Exception,Int64)","Security2\Registry\RegistrySecurity.cs","373,375,376","3","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeySetSecurityException",".ctor(Exception)","Security2\Registry\RegistrySecurity.cs","363,364","2","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeySetSecurityException",".ctor(Int64)","Security2\Registry\RegistrySecurity.cs","367,369,370","3","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.RegistryKeySetSecurityException","get_Win32ErrorCode()","Security2\Registry\RegistrySecurity.cs","356","1","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.Win32RegistrySecurity","GetRegistryKey(REGISTRY_ROOT,String,RegistryRights)","Security2\Registry\RegistrySecurity.cs","429,431,433,435,437,440,442,444","8","0","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"Security2","Security2.Win32RegistrySecurity","SetRegistryOwner(REGISTRY_ROOT,String,Security.Principal.SecurityIdentifier)","Security2\Registry\RegistrySecurity.cs","448,450,451,452,454,458,459,461,463,464,466,470,473,474,478,479,481,483,484,486,490,494,495,496","24","4","False","","REGISTRY-MODEL","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdlet","GetRelativePath(String)","NTFSSecurity\BaseCmdlets.cs","229,231","1","1","True","CopyItem2::BeginProcessing > BaseCmdlet::GetRelativePath","RELATIVE-PATH-EMPTY","defensive","Explained"
+"Security2","Security2.FileSystemAccessRule2","RemoveFileSystemAccessRuleAll(FileSystemSecurity2,List`1<IdentityReference2>)","Security2\FileSystem\FileSystemAccessRule2 Class\FileSystemAccessRule2.RemoveFileSystemAccessRulesAll.cs","15,17","1","1","True","ClearAccess::ProcessRecord > FileSystemAccessRule2::RemoveFileSystemAccessRuleAll","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"Security2","Security2.FileSystemAccessRule2/<>c__DisplayClass36_0","<RemoveFileSystemAccessRuleAll>b__0(FileSystemAccessRule)","Security2\FileSystem\FileSystemAccessRule2 Class\FileSystemAccessRule2.RemoveFileSystemAccessRulesAll.cs","17","1","0","True","ClearAccess::ProcessRecord > FileSystemAccessRule2::RemoveFileSystemAccessRuleAll > FileSystemAccessRule2/<>c__DisplayClass36_0::<RemoveFileSystemAccessRuleAll>b__0","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"Security2","Security2.FileSystemAccessRule2/<>c__DisplayClass36_1","<RemoveFileSystemAccessRuleAll>b__1(IdentityReference2)","Security2\FileSystem\FileSystemAccessRule2 Class\FileSystemAccessRule2.RemoveFileSystemAccessRulesAll.cs","17","1","0","True","ClearAccess::ProcessRecord > FileSystemAccessRule2::RemoveFileSystemAccessRuleAll > FileSystemAccessRule2/<>c__DisplayClass36_0::<RemoveFileSystemAccessRuleAll>b__0 > FileSystemAccessRule2/<>c__DisplayClass36_1::<RemoveFileSystemAccessRuleAll>b__1","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"Security2","Security2.FileSystemAuditRule2","RemoveFileSystemAuditRuleAll(FileSystemSecurity2,List`1<IdentityReference2>)","Security2\FileSystem\FileSystemAuditRule2 Class\FileSystemAuditRule2.RemoveFileSystemAuditRuleAll.cs","15,17","1","1","True","ClearAudit::ProcessRecord > FileSystemAuditRule2::RemoveFileSystemAuditRuleAll","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"Security2","Security2.FileSystemAuditRule2/<>c__DisplayClass7_0","<RemoveFileSystemAuditRuleAll>b__0(FileSystemAuditRule)","Security2\FileSystem\FileSystemAuditRule2 Class\FileSystemAuditRule2.RemoveFileSystemAuditRuleAll.cs","17","1","0","True","ClearAudit::ProcessRecord > FileSystemAuditRule2::RemoveFileSystemAuditRuleAll > FileSystemAuditRule2/<>c__DisplayClass7_0::<RemoveFileSystemAuditRuleAll>b__0","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"Security2","Security2.FileSystemAuditRule2/<>c__DisplayClass7_1","<RemoveFileSystemAuditRuleAll>b__1(IdentityReference2)","Security2\FileSystem\FileSystemAuditRule2 Class\FileSystemAuditRule2.RemoveFileSystemAuditRuleAll.cs","17","1","0","True","ClearAudit::ProcessRecord > FileSystemAuditRule2::RemoveFileSystemAuditRuleAll > FileSystemAuditRule2/<>c__DisplayClass7_0::<RemoveFileSystemAuditRuleAll>b__0 > FileSystemAuditRule2/<>c__DisplayClass7_1::<RemoveFileSystemAuditRuleAll>b__1","REMOVEALL-ACCOUNT-FILTER","unused by cmdlets","Open"
+"NTFSSecurity","NTFSSecurity.TestPath2","ProcessRecord()","NTFSSecurity\PathCmdlets\TestPath2.cs","53,55,56,65,67,68","6","0","True","TestPath2::ProcessRecord","TESTPATH-DEAD-CATCH","defensive","Explained"
+"ProcessPrivileges","ProcessPrivileges.AccessTokenHandle",".ctor(ProcessPrivileges.ProcessHandle,ProcessPrivileges.TokenAccessRights)","ProcessPrivileges\AccessTokenHandle.cs","21,23","1","1","True","DisablePrivileges::ProcessRecord > PrivilegeControl::GetPrivileges > ProcessExtensions::GetPrivileges > AccessTokenHandle::.ctor","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"ProcessPrivileges","ProcessPrivileges.AccessTokenHandle","ReleaseHandle()","ProcessPrivileges\AccessTokenHandle.cs","32,34","1","1","False","","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"ProcessPrivileges","ProcessPrivileges.Privileges","GetLuid(ProcessPrivileges.Privilege)","ProcessPrivileges\Privileges.cs","236,238","1","1","True","BaseCmdletWithPrivControl::Dispose > BaseCmdletWithPrivControl::DisableEnabledPrivileges > BaseCmdletWithPrivControl::DisablePrivilege > PrivilegeControl::DisablePrivilege > ProcessExtensions::GetPrivilegeState > ProcessExtensions::GetPrivilegeAttributes > Privileges::GetPrivilegeAttributes > Privileges::GetLuid","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"ProcessPrivileges","ProcessPrivileges.Privileges","GetPrivilegeName(ProcessPrivileges.Luid)","ProcessPrivileges\Privileges.cs","249,251,255,257,261,263","3","3","True","DisablePrivileges::ProcessRecord > PrivilegeControl::GetPrivileges > ProcessExtensions::GetPrivileges > Privileges::GetPrivileges > Privileges::GetPrivilegeName","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"ProcessPrivileges","ProcessPrivileges.Privileges","GetTokenPrivileges(ProcessPrivileges.AccessTokenHandle)","ProcessPrivileges\Privileges.cs","273,280,294,301","2","2","True","DisablePrivileges::ProcessRecord > PrivilegeControl::GetPrivileges > ProcessExtensions::GetPrivileges > Privileges::GetPrivileges > Privileges::GetTokenPrivileges","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"ProcessPrivileges","ProcessPrivileges.ProcessHandle","ReleaseHandle()","ProcessPrivileges\ProcessHandle.cs","27,29,32","3","2","False","","TOKEN-NATIVE-FAILURE","environment-specific","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdlet","GetFileSystemInfo(String)","NTFSSecurity\BaseCmdlets.cs","166,168,170,172,174,178","6","4","False","","UNUSED-CMDLET-HELPER","unused by cmdlets","Explained"
+"NTFSSecurity","NTFSSecurity.BaseCmdlet","ProcessRecord()","NTFSSecurity\BaseCmdlets.cs","145,146","2","0","True","BaseCmdlet::ProcessRecord","UNUSED-CMDLET-HELPER","unused by cmdlets","Explained"
+"Security2","Security2.Win32","GetEffectiveAccess(ObjectSecurity,IdentityReference2,String,Boolean&,Exception&)","Security2\Win32\Lib.cs","135,136","2","0","True","GetEffectiveAccess::ProcessRecord > EffectiveAccess::GetEffectiveAccess > Win32::GetEffectiveAccess","WIN32-AUTHZ-FAILURE","environment-specific","Explained"
+"Security2","Security2.Win32","GetEffectivePermissions_AuthzAccessCheck(ObjectSecurity)","Security2\Win32\Lib.cs","281","0","1","True","GetEffectiveAccess::ProcessRecord > EffectiveAccess::GetEffectiveAccess > Win32::GetEffectiveAccess > Win32::GetEffectivePermissions_AuthzAccessCheck","WIN32-AUTHZ-FAILURE","environment-specific","Explained"
+"Security2","Security2.Win32","GetEffectivePermissions_AuthzInitializeContextFromSid(IdentityReference2)","Security2\Win32\Lib.cs","245","0","1","True","GetEffectiveAccess::ProcessRecord > EffectiveAccess::GetEffectiveAccess > Win32::GetEffectiveAccess > Win32::GetEffectivePermissions_AuthzInitializeContextFromSid","WIN32-AUTHZ-FAILURE","environment-specific","Explained"
+"Security2","Security2.Win32","GetEffectivePermissions_AuthzInitializeResourceManager(String,Boolean&)","Security2\Win32\Lib.cs","188,194,196,210,218,223","3","3","True","GetEffectiveAccess::ProcessRecord > EffectiveAccess::GetEffectiveAccess > Win32::GetEffectiveAccess > Win32::GetEffectivePermissions_AuthzInitializeResourceManager","WIN32-AUTHZ-FAILURE","environment-specific","Explained"
+"Security2","Security2.Win32","IsLocalComputer(String)","Security2\Win32\Lib.cs","170,172","2","0","True","GetEffectiveAccess::ProcessRecord > EffectiveAccess::GetEffectiveAccess > Win32::GetEffectiveAccess > Win32::GetEffectivePermissions_AuthzInitializeResourceManager > Win32::IsLocalComputer","WIN32-LOCAL-NAME-LOOKUP","defensive","Explained"
+"Security2","Security2.Win32","GetByteSecurityDescriptor(Microsoft.Win32.SafeHandles.SafeFileHandle,SecurityInformationClass)","Security2\Win32\Lib.cs","311,312,315,323,325,328,330,331,332,335,336,337,339","13","2","False","","WIN32-RAW-DESCRIPTOR","unused by cmdlets","Explained"
+"Security2","Security2.Win32","GetRawSecurityDescriptor(Microsoft.Win32.SafeHandles.SafeFileHandle,SecurityInformationClass)","Security2\Win32\Lib.cs","306","1","0","False","","WIN32-RAW-DESCRIPTOR","unused by cmdlets","Explained"

Tests/Coverage/Quality-Gate-Paths-2026-10-09-ParameterSets.csv

@@ -0,0 +1,65 @@
+"Cmdlet","ParameterSet","Default","TestInvocations","TestFiles","UnclassifiedInvocationsOfCmdlet"
+"Add-NTFSAccess","PathComplex","True","33","Access (16); DriveRoot (1); FileHash (1); Inheritance (1); ObjectApis (1); PathErrors (7); PipelineControl (3); SecurityDescriptorSets (3)","2"
+"Add-NTFSAccess","PathSimple","False","6","Access (1); Inheritance (3); ObjectApis (1); PermissionScopes (1)","2"
+"Add-NTFSAccess","SDComplex","False","14","Access (4); PipelineControl (1); SecurityDescriptor (9)","2"
+"Add-NTFSAccess","SDSimple","False","2","Access (1); SecurityDescriptor (1)","2"
+"Add-NTFSAudit","PathComplex","True","27","Access (1); Audit (17); Inheritance (2); PipelineControl (4); SecurityDescriptor (1); SecurityDescriptorSets (2)","2"
+"Add-NTFSAudit","PathSimple","False","5","Audit (2); Inheritance (3)","2"
+"Add-NTFSAudit","SDComplex","False","5","Audit (4); SecurityDescriptor (1)","2"
+"Add-NTFSAudit","SDSimple","False","0","","2"
+"Clear-NTFSAccess","Path","True","6","Access (2); ObjectApis (1); PathErrors (3)","0"
+"Clear-NTFSAccess","SD","False","3","SecurityDescriptor (1); SecurityDescriptorSets (2)","0"
+"Clear-NTFSAudit","Path","True","3","Audit (3)","0"
+"Clear-NTFSAudit","SD","False","2","Audit (1); SecurityDescriptorSets (1)","0"
+"Copy-Item2","__AllParameterSets","False","6","ItemCmdlets (4); Owner (1); PipelineControl (1)","0"
+"Disable-NTFSAccessInheritance","Path","True","9","DriveRoot (1); Inheritance (2); PathErrors (3); PipelineControl (2); SecurityDescriptorSets (1)","0"
+"Disable-NTFSAccessInheritance","SecurityDescriptor","False","1","SecurityDescriptorSets (1)","0"
+"Disable-NTFSAuditInheritance","Path","True","6","Inheritance (3); PipelineControl (2); SecurityDescriptorSets (1)","0"
+"Disable-NTFSAuditInheritance","SecurityDescriptor","False","1","Inheritance (1)","0"
+"Disable-Privileges","__AllParameterSets","False","19","Audit (1); OutputTypes (2); Privileges (16)","0"
+"Enable-NTFSAccessInheritance","Path","True","3","DriveRoot (1); PathErrors (1); PipelineControl (1)","0"
+"Enable-NTFSAccessInheritance","SecurityDescriptor","False","1","SecurityDescriptorSets (1)","0"
+"Enable-NTFSAuditInheritance","Path","True","1","PipelineControl (1)","0"
+"Enable-NTFSAuditInheritance","SecurityDescriptor","False","1","SecurityDescriptorSets (1)","0"
+"Enable-Privileges","__AllParameterSets","False","5","OutputTypes (2); Privileges (3)","0"
+"Get-ChildItem2","__AllParameterSets","False","34","ItemCmdlets (28); Links (1); PipelineControl (5)","0"
+"Get-DiskSpace","__AllParameterSets","False","6","ItemCmdlets (5); PipelineControl (1)","0"
+"Get-FileHash2","__AllParameterSets","False","12","FileHash (9); OutputTypes (1); PipelineControl (2)","0"
+"Get-Item2","__AllParameterSets","False","17","Access (2); Audit (5); Inheritance (4); ItemCmdlets (1); ObjectApis (1); Owner (1); PipelineControl (1); SecurityDescriptor (2)","0"
+"Get-NTFSAccess","Path","True","25","Access (12); DriveRoot (3); Inheritance (6); PermissionScopes (1); PipelineControl (1); Privileges (1); SecurityDescriptorSets (1)","2"
+"Get-NTFSAccess","SD","False","1","Access (1)","2"
+"Get-NTFSAudit","Path","False","24","Audit (11); Inheritance (6); PipelineControl (3); SecurityDescriptor (1); SecurityDescriptorSets (3)","2"
+"Get-NTFSAudit","SD","False","1","Audit (1)","2"
+"Get-NTFSEffectiveAccess","Path","True","11","Access (10); PipelineControl (1)","1"
+"Get-NTFSEffectiveAccess","SecurityDescriptor","False","2","Access (2)","1"
+"Get-NTFSHardLink","__AllParameterSets","False","9","Links (7); Owner (1); PipelineControl (1)","0"
+"Get-NTFSInheritance","Path","True","21","Audit (1); Inheritance (12); ObjectApis (3); PipelineControl (3); SecurityDescriptorSets (2)","0"
+"Get-NTFSInheritance","SecurityDescriptor","False","2","Inheritance (2)","0"
+"Get-NTFSOrphanedAccess","Path","False","4","Access (3); PipelineControl (1)","0"
+"Get-NTFSOrphanedAccess","SD","False","1","Access (1)","0"
+"Get-NTFSOrphanedAudit","Path","False","9","Audit (8); PipelineControl (1)","2"
+"Get-NTFSOrphanedAudit","SD","False","0","","2"
+"Get-NTFSOwner","Path","True","23","DriveRoot (1); FileHash (2); Inheritance (2); ObjectApis (3); Owner (6); PipelineControl (1); Privileges (7); SecurityDescriptorSets (1)","2"
+"Get-NTFSOwner","SecurityDescriptor","False","0","","2"
+"Get-NTFSSecurityDescriptor","__AllParameterSets","False","77","Access (14); Audit (11); DriveRoot (1); Inheritance (10); ObjectApis (4); Owner (2); PermissionScopes (2); PipelineControl (2); SecurityDescriptor (22); SecurityDescriptorSets (9)","0"
+"Get-NTFSSimpleAccess","Path","False","20","Access (19); PipelineControl (1)","2"
+"Get-NTFSSimpleAccess","SD","False","1","Access (1)","2"
+"Get-Privileges","__AllParameterSets","False","18","Access (2); Audit (4); FileHash (1); Inheritance (1); ObjectApis (1); OutputTypes (2); Owner (1); PathErrors (2); PipelineControl (1); Privileges (2); SecurityDescriptor (1)","0"
+"Move-Item2","__AllParameterSets","False","7","ItemCmdlets (6); PipelineControl (1)","0"
+"New-NTFSHardLink","__AllParameterSets","False","14","Links (14)","0"
+"New-NTFSSymbolicLink","__AllParameterSets","False","12","ItemCmdlets (1); Links (10); OutputTypes (1)","0"
+"Remove-Item2","__AllParameterSets","False","15","ItemCmdlets (1); Owner (1); PipelineControl (2); Remove-Item2 (11)","0"
+"Remove-NTFSAccess","PathComplex","True","13","Access (10); DriveRoot (1); PathErrors (1); PipelineControl (1)","2"
+"Remove-NTFSAccess","PathSimple","False","0","","2"
+"Remove-NTFSAccess","SDComplex","False","4","Access (4)","2"
+"Remove-NTFSAccess","SDSimple","False","0","","2"
+"Remove-NTFSAudit","PathComplex","True","7","Audit (6); PipelineControl (1)","1"
+"Remove-NTFSAudit","PathSimple","False","0","","1"
+"Remove-NTFSAudit","SDComplex","False","2","Audit (2)","1"
+"Remove-NTFSAudit","SDSimple","False","0","","1"
+"Set-NTFSInheritance","Path","True","14","Inheritance (12); PathErrors (1); PipelineControl (1)","0"
+"Set-NTFSInheritance","SecurityDescriptor","False","5","Inheritance (5)","0"
+"Set-NTFSOwner","Path","True","8","FileHash (1); Owner (5); PipelineControl (2)","1"
+"Set-NTFSOwner","SecurityDescriptor","False","2","Owner (2)","1"
+"Set-NTFSSecurityDescriptor","__AllParameterSets","False","29","Audit (1); Inheritance (4); Owner (1); PipelineControl (2); SecurityDescriptor (15); SecurityDescriptorSets (6)","0"
+"Test-Path2","__AllParameterSets","False","14","ItemCmdlets (7); Links (6); PipelineControl (1)","0"

Tests/Coverage/Quality-Gate-Paths-2026-10-09-RedGreen-Logs.csv

@@ -0,0 +1,41 @@
+"State","Commit","Configuration","Log","Bytes","SHA256"
+"S0","f11ff41","elevateddesktop","redgreen/S0/elevateddesktop.log","153301","8AD81D6CA40F3E6FAF854F9AD1F0F8D9FFEAE501DD95AA26398A91238F130A90"
+"S0","f11ff41","elevatedcore","redgreen/S0/elevatedcore.log","139107","0E356271CE54C0BB3295B16B94376E807C1433FA9B39C4A5475425C9A00EB2D5"
+"S0","f11ff41","basicdesktop","redgreen/S0/basicdesktop.log","163761","C5044850C31B48AD0DEB4811C68A20F2D0B12B63C82A3538A0769812E850D639"
+"S0","f11ff41","basiccore","redgreen/S0/basiccore.log","149826","4E6CCA3D4E43A93A0132147FBA2A4257B36069EB377BA5ECC3240924011E41F0"
+"S1","b14c90b","elevateddesktop","redgreen/S1/elevateddesktop.log","147261","F95D9B8C209BBBAF4A4733D46C6BA364E89731BDD430F6FD3D1C6FE8994024E3"
+"S1","b14c90b","elevatedcore","redgreen/S1/elevatedcore.log","133239","0499FD8EE275B3B8E51AC89CE75BDF0EFA56EBBF867F01836A41E99444F72E67"
+"S1","b14c90b","basicdesktop","redgreen/S1/basicdesktop.log","157716","BACF46A9499BE54D4F9B3894028CEE832214E3CB14F32E672FA306A58F2B147E"
+"S1","b14c90b","basiccore","redgreen/S1/basiccore.log","143867","0785A7430FD648B79B430D57F10D9D02D06761B531A57451C971B5FAFD299701"
+"S2","c7a0383","elevateddesktop","redgreen/S2/elevateddesktop.log","145073","536914D0622225027721EBBFFA6C0D290B0BB79D8ABB316777B7691E3150ED93"
+"S2","c7a0383","elevatedcore","redgreen/S2/elevatedcore.log","131107","C60A7B7BCB444F28CFD109D1FDF47F8004F19599954C1BF6927CECF0001254CF"
+"S2","c7a0383","basicdesktop","redgreen/S2/basicdesktop.log","155534","26CE04E2B1454AF4D11795F59899D9FC9EAC2FA0925BE27130F0926D19C33E87"
+"S2","c7a0383","basiccore","redgreen/S2/basiccore.log","141731","FE431772D6EF3D359A04ECF6751253F383EFE5A3809934A362A17FF2099B5AA9"
+"S3","2909a1c","elevateddesktop","redgreen/S3/elevateddesktop.log","142723","52C1241B11DEC3037F7EFDDCA014358C407D62B1FABC4201E9A533000D1303A1"
+"S3","2909a1c","elevatedcore","redgreen/S3/elevatedcore.log","128849","AF8C0C175E2D08A8D568EBF107FB5A5B08A5448399A974ABAE5677581A157366"
+"S3","2909a1c","basicdesktop","redgreen/S3/basicdesktop.log","154347","9DEB67568047AEADE5670DB77CBECBBDE6342188E2074BF03893C5485CB1DAAE"
+"S3","2909a1c","basiccore","redgreen/S3/basiccore.log","140589","E18744BD9D0A5B9F69150B43E526BC95B92849F9FF6FC9A43D5425860131BE18"
+"S4","c77ecbf","elevateddesktop","redgreen/S4/elevateddesktop.log","113411","9278A340122557D4F29A6DD61709274F0B1E46ADBB16EC27F7884FE2CBAE3CF1"
+"S4","c77ecbf","elevatedcore","redgreen/S4/elevatedcore.log","99977","DD3FDB28C62E40B1958859F1C570263ACC1A728652C9CA5BE3ACA05E9F7D2EB9"
+"S4","c77ecbf","basicdesktop","redgreen/S4/basicdesktop.log","125024","9B5B73A8B419BCA1F921A834770692CB48595703D9945A4BBCE6F99134DB5105"
+"S4","c77ecbf","basiccore","redgreen/S4/basiccore.log","111710","A9DFF033F718B4B62C9FC32369C49A5C424560DDE6F2DAB1E80777B5B66ABEC1"
+"S5","ee7c105","elevateddesktop","redgreen/S5/elevateddesktop.log","112510","C05F3269C9FF31880EDA679BB18722BA178E872736CAA79C1BAB05CC2A8F4707"
+"S5","ee7c105","elevatedcore","redgreen/S5/elevatedcore.log","99110","985B3D41235CEECE542F9975BBE157FD1B855E75BB756A21E9C4903561AD0438"
+"S5","ee7c105","basicdesktop","redgreen/S5/basicdesktop.log","124131","1468119C479D87CDAC9E5EA9A41E0B046F768F64A4325BCA517CAF23A664B60C"
+"S5","ee7c105","basiccore","redgreen/S5/basiccore.log","110829","BFAB06F08756BB9A5723EAC94EE74EBF9F7B801230D97830A0DBAF2E116E019A"
+"S6","ae3078f","elevateddesktop","redgreen/S6/elevateddesktop.log","110594","423BE1E4F05FEA407077380676106E22427408DFED0843C5B8381E835C4E1684"
+"S6","ae3078f","elevatedcore","redgreen/S6/elevatedcore.log","97221","4F4075433D755FC01703DAC7A601D6C6738581BD7C1035D11DB1162581B02C00"
+"S6","ae3078f","basicdesktop","redgreen/S6/basicdesktop.log","122224","29E8F41737B20090B3DE5181D249FED0C7FECBC0F87A8103F5497A3394C16069"
+"S6","ae3078f","basiccore","redgreen/S6/basiccore.log","108928","F5857D66F68AFB58ED94EE9C1BABF53FCB88F8EA6C4DF42018B7B8876DD39B18"
+"S7","40bf6a8","elevateddesktop","redgreen/S7/elevateddesktop.log","93289","465E86473B527421A4172403C4E77C299A78FAB919C1C373B48DFD533863480E"
+"S7","40bf6a8","elevatedcore","redgreen/S7/elevatedcore.log","80285","37A0E26F20E30F2FE5A1D89BC652D196B8FC9111689D55736BA6096FCDD989C1"
+"S7","40bf6a8","basicdesktop","redgreen/S7/basicdesktop.log","104902","6F9CA5107BC733AC6A534E3E4C0890981FF8247A82EB731DB317CC9D4B5765F8"
+"S7","40bf6a8","basiccore","redgreen/S7/basiccore.log","91985","697450AE2EC6082D3E03E91B50B9E8DBF86AC25F74A9004C4EE1AC92C4D35EC6"
+"S8","7aa8315","elevateddesktop","redgreen/S8/elevateddesktop.log","93300","979F16CB8C434D8EC2824339C90837446DAB52BBAF398AEA0BCFD32ED90340BE"
+"S8","7aa8315","elevatedcore","redgreen/S8/elevatedcore.log","80288","396423C7C0A9C7898AE2AAFF56C924430FEDF9900BEC597A7C46295B5280D696"
+"S8","7aa8315","basicdesktop","redgreen/S8/basicdesktop.log","104911","B3380A7F637B2E70AFEAB531334F5510BD674CDA14A84CB6622A44D88AA7B188"
+"S8","7aa8315","basiccore","redgreen/S8/basiccore.log","92014","2C80201F942889AF44690A63E2EFD134A0C290C89C49078740FA5A031DC90BDB"
+"S9","d44a200","elevateddesktop","redgreen/S9/elevateddesktop.log","90808","C44DED5A4C2B0198215E417D7B7CD8B589324A5AA9CE6BEADCC1BAC33BAB4E5E"
+"S9","d44a200","elevatedcore","redgreen/S9/elevatedcore.log","77862","4DD3B548A1C12D812C4EEEE86A290EADF091C46FA314D2752EDE714FDA483B12"
+"S9","d44a200","basicdesktop","redgreen/S9/basicdesktop.log","103983","48822DC49C252D25707E85C0BC738EFE0B2679DAC96EC7B9C3FFBE1ABC0ECFCB"
+"S9","d44a200","basiccore","redgreen/S9/basiccore.log","91115","7C2F111FE688EB24D8644945793E84F7F6112BDA5DE8CBAF93A7527B3CEC2FDB"

Tests/Coverage/Quality-Gate-Paths-2026-10-09-RedGreen.csv

@@ -0,0 +1,75 @@
+"Step","FixCommit","Kind","File","Test","ElevatedDesktop","ElevatedCore","BasicDesktop","BasicCore"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Access rule helpers that take a path.Should add the entry of a rule that carries its path","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Privilege output comparisons and formatting.Should compare boxed and typed privilege values consistently without accepting an attributes enum","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Rule constructors with a path.Should preserve the supplied path and name of an access rule","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Rule constructors with a path.Should preserve the supplied path and name of an audit rule","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Simplified audit entries.Should compare audit entries reflexively and symmetrically, never as access entries","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Simplified audit entries.Should preserve the path, account and ReadData when converting an audit entry","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Simplified audit entries.Should reduce ReadData to Read","1","1","1","1"
+"f11ff41 to b14c90b","b14c90b","red before, green after","ObjectApis","Simplified entry comparison branches.Should distinguish identities, rights and types in audit entries and keep equal hashes consistent","1","1","1","1"
+"b14c90b to c7a0383","c7a0383","red before, green after","PathErrors","An item whose owner may not change its permissions.Clear-NTFSAccess -DisableInheritance should take ownership, clear and protect the DACL, and not set an unchanged owner back","1","1","1","1"
+"b14c90b to c7a0383","c7a0383","red before, green after","SecurityDescriptor","Set-NTFSSecurityDescriptor.When the write is denied until the cmdlet takes ownership.Should not report an owner that did not change when the write that took ownership leaves an empty DACL","1","1","1","1"
+"c7a0383 to 2909a1c","2909a1c","red before, green after","Access","InheritedFrom of access entries.Should name an unknown parent for an inherited entry and no source for an explicit entry when Windows cannot resolve the folders","1","1","1","1"
+"c7a0383 to 2909a1c","2909a1c","red before, green after","Audit","InheritedFrom of audit entries.Should name an unknown parent for an inherited entry and no source for an explicit entry when the privilege is disabled","1","1","0","0"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command and the error of a folder that Get-ChildItem2 cannot read.Should leave the loop for a break of a later command that takes the error of a nested folder","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command and the error of a folder that Get-ChildItem2 cannot read.Should leave the loop for a continue of a later command that takes the error of a nested folder","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Copy-Item2 should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Copy-Item2 should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Copy-Item2 should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Copy-Item2 should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-ChildItem2 should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-ChildItem2 should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-DiskSpace should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-DiskSpace should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-DiskSpace should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-DiskSpace should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSecurityDescriptor should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSecurityDescriptor should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSecurityDescriptor should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSecurityDescriptor should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSimpleAccess should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSimpleAccess should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSimpleAccess should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSimpleAccess should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Move-Item2 should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Move-Item2 should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Move-Item2 should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Move-Item2 should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Remove-Item2 should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Remove-Item2 should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Remove-Item2 should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Remove-Item2 should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should stop at the debug message for Select-Object -First 1 of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should leave the loop for break after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should leave the loop for continue after its first object and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should stop after the first object for Select-Object -First 1 and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should stop for a terminating error (Write-Error -ErrorAction Stop) of the later command and change nothing else","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","Recognizing the end of a pipeline by the type of the exception.Should not recognize <Description>","3","3","3","3"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","Recognizing the end of a pipeline by the type of the exception.Should recognize a PipelineStoppedException","1","1","1","1"
+"2909a1c to c77ecbf","c77ecbf","red before, green after","PipelineControl","Recognizing the end of a pipeline by the type of the exception.Should recognize an exception whose base type is the flow control exception of PowerShell","1","1","1","1"
+"c77ecbf to ee7c105","ee7c105","red before, green after","ItemCmdlets","Get-ChildItem2.Recursion, type filters, and depth.Should find a file whose name contains brackets by that name with -Filter","1","1","1","1"
+"ee7c105 to ae3078f","ae3078f","red before, green after","ItemCmdlets","Get-ChildItem2.Recursion, type filters, and depth.Should reject a null -Filter","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Copy-Item2 should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-ChildItem2 should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-DiskSpace should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-FileHash2 should stop at the verbose message for Select-Object -First 1 of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-FileHash2 should stop at the verbose message for throw of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSecurityDescriptor should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Get-NTFSSimpleAccess should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Move-Item2 should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Remove-Item2 should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should stop at the debug message for throw of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSOwner should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should stop at the verbose message for Select-Object -First 1 of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should stop at the verbose message for throw of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that ends the pipeline.Set-NTFSSecurityDescriptor should stop for a terminating error (throw) of the later command and change nothing else","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that throws an exception of a type that a cmdlet handles.Get-ChildItem2 should pass on a thrown UnauthorizedAccessException","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","PipelineControl","A later command that throws an exception of a type that a cmdlet handles.Remove-Item2 should pass on a thrown IOException and leave the next item","1","1","1","1"
+"ae3078f to 40bf6a8","40bf6a8","red before, green after","ItemCmdlets","Get-ChildItem2.Recursion, type filters, and depth.Should return every item for -Filter *.*, also the ones without a dot in their names","1","1","1","1"
+"7aa8315 to d44a200","d44a200","red before, green after","PipelineControl","A later command and the error of a folder that Get-ChildItem2 cannot read.Should pass on what a later command throws when it takes the error of a nested folder","1","1","1","1"
+"7aa8315 to d44a200","d44a200","red before, green after","Privileges","Privileges when a later command takes the debug messages of the cmdlet.Should disable the privilege when Select-Object -First ends the pipeline at the message after its enabling","1","1","0","0"
+"7aa8315 to d44a200","d44a200","red before, green after","Privileges","Privileges when a later command takes the debug messages of the cmdlet.Should pass on what a later command throws at the message after the enabling and disable the privileges","1","1","0","0"

Tests/Coverage/Quality-Gate-Paths-2026-10-09.md

@@ -0,0 +1,649 @@
+# Quality-gate path review, 2026-10-09
+
+Handoff 1 of the quality gate before 5.0.0. The C# code that no test visited
+at `3442194` was inventoried again. Each path is now covered by a behavior
+test or explained from source, and the evidence of every explanation is
+named. The work is on `ai/quality-gate-paths`, from the reviewed head
+`f11ff41` of `ai/quality-gate-coverage` (#117). Nothing was pushed, merged,
+tagged, or published; the stable version stays 4.2.6 and rc6 is the latest
+published candidate. Cmdlet design and the fate of unused classes stay with
+the maintainer (Decisions 16, 21, and 22; Decision 22 is still proposed).
+
+This report does not close the quality gate. A coverage percentage never
+closes it, the [open items](#open-items-for-the-maintainer) remain, and the
+fixes below still need the lab acceptance of gate 3.
+
+## Candidate and source identity
+
+- Measured source: `5a5d58b` (`5a5d58b88c639ca560bc1e66b17d57cc6e682eca`).
+  Two commits follow it and change no test and no executable code: the
+  first rewords a code comment in `NTFSSecurity\BaseCmdlets.cs` and one
+  sentence of the `Get-ChildItem2` page with its generated help, as the last
+  review passes asked; the second adds this report, its tables (with the
+  red/green rows), the appendix, and the Memory Bank notes.
+- Base `f11ff41`. Since then 26 commits up to the measured source (8 `fix`,
+  1 `refactor`, 16 `test`, 1 `docs`): 40 files, 3,708 insertions and 80
+  deletions. Production code is 18 files with 277 insertions and 52
+  deletions (the four projects, without the generated help); the rest is
+  tests, documentation, and help.
+- Build: Release, .NET Framework 4.5.2, 0 errors and 317 warnings: 296 of
+  CS1591, 19 of CS1574, one of CS0169, and one of CS0618. All are legacy and
+  none was suppressed.
+- Tools: Windows PowerShell 5.1.26100, PowerShell 7.6.6, Pester 5.7.1,
+  AltCover 9.0.145 (net472).
+- The measured assemblies are the Release files that the Validate run used.
+  AltCover saved them unchanged before it instrumented them:
+
+| Assembly | SHA-256 |
+| --- | --- |
+| `NTFSSecurity.dll` | `155DE103C14A7CC69BA179D0AE4EEFA81DCF6F43A34B1856BC01393DDB76D443` |
+| `Security2.dll` | `F6E4B6340F55A070B8E7D7678B7A6289E1A8430D393618EC269A315D70F32FC7` |
+| `ProcessPrivileges.dll` | `7D037B32AED6C5879993C431F3EB614D61A621C8AF3474B59A6E0A5C451E3016` |
+| `PrivilegeControl.dll` | `06FBD3337FAB9CE541F9030803468B7759935E152FB814E99F1C15CE9FA82D73` |
+
+The Release build is not byte-reproducible: another build of the same source
+gives other hashes, so these identify the measured files, not the source.
+
+## Local validation
+
+Four configurations in separate processes with the CI wrappers: Windows
+PowerShell 5.1 and PowerShell 7, each elevated and as a basic user through
+a restricted token. Each discovered 1,310 test cases (914 at `f11ff41`),
+and no test failed. The instrumented coverage runs that followed gave the same
+counts.
+
+| Configuration | Passed | Failed | Skipped | Total |
+| --- | ---: | ---: | ---: | ---: |
+| Windows PowerShell 5.1, elevated | 1,286 | 0 | 24 | 1,310 |
+| Windows PowerShell 5.1, basic user | 1,076 | 0 | 234 | 1,310 |
+| PowerShell 7, elevated | 1,255 | 0 | 55 | 1,310 |
+| PowerShell 7, basic user | 1,045 | 0 | 265 | 1,310 |
+
+Skip eligibility is checked by row, not by name. NUnit keeps the placeholders
+of a skipped data row, so skipped and executed names do not match. Each
+configuration ran the suite once more in one Pester process, and every row
+was recorded with its file, line, path, name, data, and result. The skipped
+rows were 24, 234, 55, and 265, the same counts as in the validation runs.
+The 578 skipped rows are 137 distinct tests, 350 of them rows with data.
+Every skipped row has the same test, with the same data, executed in two
+other configurations; no skipped row lacks an executed counterpart.
+
+## Coverage
+
+AltCover 9.0.145 OpenCover report of the frozen source, with the method of
+the `3442194` baseline: the four configurations ran one after the other
+without `--save`, from copied Release assemblies with their PDBs, AlphaFS and
+System.Management.Automation excluded, and `runner --collect` recalculated
+the report. The ratios are visited sequence or branch points divided by their
+totals, not unique source lines.
+
+| Assembly | Sequence points | Sequence coverage | Branch points | Branch coverage |
+| --- | ---: | ---: | ---: | ---: |
+| NTFSSecurity | 1,912/2,168 | 88.19% | 683/1,094 | 62.43% |
+| Security2 | 1,055/1,225 | 86.12% | 506/742 | 68.19% |
+| ProcessPrivileges | 205/219 | 93.61% | 72/125 | 57.60% |
+| PrivilegeControl | 20/22 | 90.91% | 12/17 | 70.59% |
+| Aggregate | 3,192/3,634 | 87.84% | 1,273/1,978 | 64.36% |
+
+| Measurement | Sequence points | Branch points |
+| --- | ---: | ---: |
+| `3442194`, the baseline of this work | 2,641/3,559 (74.21%) | 974/1,933 (50.39%) |
+| `73a0a7e` | 2,826/3,563 (79.32%) | 1,091/1,935 (56.38%) |
+| `360417a` | 2,860/3,566 (80.20%) | 1,105/1,939 (56.99%) |
+| `51412e0` | 3,067/3,566 (86.01%) | 1,192/1,939 (61.48%) |
+| `d0acda3` | 3,079/3,566 (86.34%) | 1,207/1,939 (62.25%) |
+| `3c19747` | 3,133/3,592 (87.22%) | 1,250/1,966 (63.58%) |
+| `ae3078f` | 3,134/3,592 (87.25%) | 1,252/1,966 (63.68%) |
+| `40bf6a8` | 3,166/3,626 (87.31%) | 1,257/1,977 (63.58%) |
+| `a50070a` | 3,168/3,626 (87.37%) | 1,259/1,977 (63.68%) |
+| `7aa8315` | 3,168/3,626 (87.37%) | 1,257/1,975 (63.65%) |
+| `d61dffa` | 3,192/3,634 (87.84%) | 1,273/1,978 (64.36%) |
+| `5a5d58b`, final | 3,192/3,634 (87.84%) | 1,273/1,978 (64.36%) |
+
+- The sequence-point ratio rose from 74.21% to 87.84%, and the number of
+  unvisited points fell from 918 to 442. The production code changed as well
+  (3,559 to 3,634 points, because of the fixes), so the ratios are not
+  increments of one source.
+- The branch summary counts 820 compiler-generated points (patterns such as
+  `foreach` and `using`), of which only 185 are visited. The explicit branch
+  points that a person wrote are 1,088/1,158 (93.96%).
+- The interim measurements stopped at the commits that are named; they show
+  the progress, not a different method. `d61dffa` and `5a5d58b` give the same
+  counts: the commits between them changed tests, documentation, and the
+  wording of one code comment only.
+
+## What the work changed
+
+### Tests
+
+136 `It` blocks were added; with data rows the suite grew from 914 to
+1,310 cases per configuration. The tests assert state on disk, error ID,
+category and target, continuation after a failure, the owner of the item, and
+that a failed item writes no success-shaped object.
+
+| Area | Test files | New `It` blocks |
+| --- | --- | ---: |
+| Public rule, identity, descriptor, and comparison objects, inheritance helpers, privilege objects, the extension methods | ObjectApis | 46 |
+| Token handles, the privilege enabler and its finalizer, privilege control, the Init script, a privilege that a later command interrupts | Privileges | 17 |
+| Item cmdlets, filters and their dot rules, depth, links, hard links, root-drive changes, disk space | ItemCmdlets, DriveRoot, Links | 24 |
+| Access, audit, inheritance, owner, hash, and path errors; deny entries without rights; a NULL DACL | Access, Audit, Inheritance, Owner, FileHash, PathErrors | 25 |
+| Security descriptors | SecurityDescriptor | 3 |
+| A later command that ends the pipeline, for all 30 cmdlets and for the verbose, debug, and error streams | PipelineControl | 15 |
+| The test helpers | TestHelpers | 6 |
+
+### Defects found and fixed
+
+| # | Defect | Fixed in | Regression guard |
+| --- | --- | --- | --- |
+| 1 | Public rule constructors lost the supplied path; simplified audit entries kept `ReadData` and were compared with access entries; boxed privilege values were compared wrongly | `b14c90b` | ObjectApis.Tests; 8 rows in each configuration |
+| 2 | `Clear-NTFSAccess -DisableInheritance` and `Set-NTFSSecurityDescriptor` reported `RestoreOwnerError` for an owner that had not changed | `c7a0383` | PathErrors and SecurityDescriptor tests; 2 rows in each configuration |
+| 3 | `InheritedFrom` read `unknown paren` and showed it for explicit entries | `2909a1c` | Access and Audit tests; 2 rows in the elevated configurations and 1 in the basic ones (the audit row needs the privilege) |
+| 4 | Nine cmdlets handled the end of the pipeline (`break`, `continue`, `Select-Object -First`) as a failure of the item and went on; `Remove-Item2 -PassThru \| Select-Object -First 1` removed every item | `c77ecbf` | PipelineControl.Tests; 42 rows in each configuration: 35 for the nine cmdlets, 2 for the error of a nested folder, and 5 that pin the new check by type |
+| 5 | `Get-ChildItem2 -Filter` read a bracket as a character class, so `Report[1].txt` was not found by its name | `ee7c105` | ItemCmdlets.Tests; 1 row in each configuration |
+| 6 | A null `-Filter` ended in a `NullReferenceException`; introduced by fix 5 and never released | `ae3078f` | ItemCmdlets.Tests; 1 row in each configuration |
+| 7 | A `throw` of a later command reaches a cmdlet through its Write call as an ordinary exception; the catch for the failures of an item reported it as the error of the item and went on, so that `Remove-Item2` removed the next item and the caller never saw the exception. Fix 4 found only the end of the pipeline by its type. `Set-NTFSSecurityDescriptor`, `Get-FileHash2`, and `Set-NTFSOwner` caught it also at a verbose or debug message | `40bf6a8` | PipelineControl.Tests; 16 rows in each configuration: 9 for a `throw` of the later command, 5 for a verbose or debug message, and 2 for a thrown type that a cmdlet handles. The rows for `Write-Error -ErrorAction Stop` of the later command turn green with fix 4, not with this one |
+| 8 | `Get-ChildItem2 -Filter *.*` dropped the items without a dot in their names, most folders among them, so a listing with that filter missed them | `40bf6a8` | ItemCmdlets.Tests; 1 row in each configuration; found by a probe and by the independent review |
+| 9 | The failed lookup of `InheritedFrom` leaked its native buffer | `40bf6a8` | none: no observable behavior, and the fallback tests run the path |
+| 10 | `Get-ChildItem2` swallowed what a later command threw for an error that the cmdlet wrote for a nested folder, for example `Get-ChildItem2 -Recurse -File 2>&1 \| ForEach-Object { throw 'x' }`: the recursion took it for a failure of the folder above, wrote a verbose message, and ended the listing early, and the caller never saw the exception | `d44a200` | PipelineControl.Tests; 1 row in each configuration. The `break`, `continue`, and `-ErrorAction Stop` cases on the same error pass before and after |
+| 11 | A cmdlet that enables the privileges left a privilege enabled when a later command ended the pipeline (`5>&1 \| Select-Object -First 2`) or threw at the debug message after the enabling: it noted the privilege only after that message, and `TryEnablePrivilege` took the exception for a failure to enable it and went on, so that all four privileges stayed enabled and the exception was lost | `d44a200` | Privileges.Tests; 2 rows in the elevated configurations (they need the privileges) |
+
+Fixes 4, 7, and 10 changed the catch blocks of 10 cmdlets (`Get-DiskSpace`
+now writes outside its try). Fixes 7 and 10 added a record of the exception
+that the `WriteObject`, `WriteError`, `WriteVerbose`, and `WriteDebug`
+methods of `BaseCmdlet` raise, which every catch-all that writes directly
+passes on. `WriteWarning` is not noted: no catch-all encloses it. A scan of
+the source finds 85 catch-all handlers under `NTFSSecurity\`. Sixteen of
+them enclose a Write call directly in their try block: eleven pass the
+exception on, and the other five are the Write methods themselves, which
+record it and rethrow. Seventeen enclose only a helper, `InvokeAsOwner` or
+`WriteChangesAsOwner`, whose owner restore can write a `RestoreOwnerError`;
+they do not pass the exception on (open item 8). The scan is a text match
+and cannot see a write inside another helper. The type check
+`PipelineControl.IsEnd` remains as a second line of defense (open item 9).
+
+### Red before, green after
+
+The last column of the table above counts the test rows that fail on the
+production code before a fix and pass after it. The first runs that showed
+this were taken as each fix was written, with the tests of that commit. Their
+logs were deleted with the temporary run folders, so their counts could not be
+reproduced, and they are not used here. The evidence was measured again with
+the final tests.
+
+The eight test files that guard the fixes (ObjectApis, Access, Audit,
+PathErrors, SecurityDescriptor, PipelineControl, ItemCmdlets, and Privileges:
+650 cases per configuration) were laid over the production code of ten states
+of the branch: the base `f11ff41`, the commit of each fix, the refactoring
+`7aa8315`, and `d44a200`, the last commit that changes behavior. Each state was
+built in Release in a separate worktree and run in the four configurations
+with the focused runner of this work, the one that the mutation rounds use. It
+runs only these eight files with its own Pester configuration, sets
+`$ErrorActionPreference` to `Stop` like the CI wrappers, starts the basic runs
+with `runas /trustlevel:0x20000`, and writes no NUnit file. A row that fails
+at a state and passes at the next one is a guard of the fix between them; a
+row that passes before and fails after would be a break.
+
+| Step | Defects | Rows red before and green after: elevated 5.1, elevated 7, basic 5.1, basic 7 | Test files |
+| --- | --- | --- | --- |
+| Rows red at the base `f11ff41` | all | 76, 76, 73, 73 | |
+| `f11ff41` to `b14c90b` | 1 | 8, 8, 8, 8 | ObjectApis |
+| `b14c90b` to `c7a0383` | 2 | 2, 2, 2, 2 | PathErrors, SecurityDescriptor |
+| `c7a0383` to `2909a1c` | 3 | 2, 2, 1, 1 | Access, Audit |
+| `2909a1c` to `c77ecbf` | 4 | 42, 42, 42, 42 | PipelineControl |
+| `c77ecbf` to `ee7c105` | 5 | 1, 1, 1, 1 | ItemCmdlets |
+| `ee7c105` to `ae3078f` | 6 | 1, 1, 1, 1 | ItemCmdlets |
+| `ae3078f` to `40bf6a8` | 7, 8, 9 | 17, 17, 17, 17 | ItemCmdlets, PipelineControl |
+| `40bf6a8` to `7aa8315` | none (refactoring) | 0, 0, 0, 0 | none |
+| `7aa8315` to `d44a200` | 10, 11 | 3, 3, 1, 1 | PipelineControl, Privileges |
+| Rows red at `d44a200`, the control | none | 0, 0, 0, 0 | |
+
+The steps add up to the rows that are red at the base, and no row passes at one
+state and fails at the next in any configuration. At `d44a200` no row of the
+650 fails in any configuration; the production code after it differs only in
+an XML comment of `BaseCmdlets.cs`. The counts are of rows, not of names:
+three rows that Pester lists under one unexpanded template name (see below)
+make a count of names two lower for the first four states. In all 40 logs (10
+states, 4 configurations), the failed count of the `RESULT` line, the number
+of `FAILEDTEST` lines, and the rows in the CSV file agree. The commit that
+each state was built from is the `source=` line of its build log, and it equals
+the commit that the table names for all ten states; the assemblies of the
+states were not hashed, because each build rewrote the hash file of the
+frozen runner.
+[`Quality-Gate-Paths-2026-10-09-RedGreen.csv`](Quality-Gate-Paths-2026-10-09-RedGreen.csv)
+lists each guard test with its test file and its rows per configuration, and
+[`Quality-Gate-Paths-2026-10-09-RedGreen-Logs.csv`](Quality-Gate-Paths-2026-10-09-RedGreen-Logs.csv)
+lists the 40 logs with their sizes and SHA-256 values.
+
+- Of the 42 rows of fix 4, 37 call the cmdlets. The other five pin the new
+  check by type, `IsEnd`, through reflection, and are red before only because
+  that check did not exist. Three of them are the rows of one data-driven
+  test; the `BeforeAll` of their block fails without the type, so Pester
+  lists them under the unexpanded template name.
+- The 17 rows of the step to `40bf6a8` are 16 for defect 7 and one for defect
+  8, the `*.*` row. Defect 9 has no row.
+- The audit row of fix 3 and the two rows of fix 11 need the privileges. They
+  are skipped in the basic configurations, and the eligibility check shows
+  that each of them is executed in the elevated ones.
+- The matrix ran the verbose and debug rows of defect 7 as they are, with
+  `-ErrorAction SilentlyContinue`. They need it: under `Stop` and without it,
+  a handler that reports the exception of the later command as an error of the
+  item ends the pipeline with it, and the row cannot tell that from passing
+  the exception on (the mutations M19 and M20 escaped for this reason at
+  `d61dffa`, see below).
+- One of these rows fails without a message before fix 7, in all four
+  configurations: `Set-NTFSSecurityDescriptor`, verbose message,
+  `Select-Object -First 1`. The other rows name what they expected. The
+  matrix alone does not say why this one fails. The attribution to fix 7 rests
+  on the source and on a mutation: at `ae3078f` the verbose message is written
+  inside a try whose catch reports the exception as `WriteSdError` and goes on
+  (`SetSecurityDescriptor.cs`, lines 47, 51, and 68), and the mutation M16,
+  which removes that pass-on at the final source, fails this row with the same
+  empty message in all four configurations.
+- The matrix lays the final tests over earlier production code. It shows that
+  a guard fails without its fix and passes with it, not how the test looked
+  when it was first written, and a test that needs two fixes flips at the
+  later step. The rows that pass at the base are characterization tests and
+  tests of behavior that no fix changed; the mutations of the next section,
+  not this matrix, show that they detect a change.
+
+### Where a test or a classification was wrong
+
+These cases are why an explanation below is a claim with evidence, not a
+fact.
+
+- The first version of the restored-owner test passed without reaching the
+  retry, because a deny entry for the user does not stop an owner. It now
+  uses an OWNER RIGHTS deny and asserts that a plain write is denied.
+- The `continue` after the second name comparison of `Get-ChildItem2` was
+  first classified as defensive. A probe showed that `*.*` reaches it, which
+  led to defect 8.
+- A mutation that removed that comparison escaped at `630926f`, and
+  checking why exposed defect 5.
+- The throw rows that the independent review asked for exposed defect 7.
+- The review claimed that `Get-ChildItem2 -Recurse -ErrorAction Stop`
+  swallows the error of a nested folder. A probe on the build of `7aa8315`
+  showed that this error reaches the caller in both editions (a pipeline
+  stop, which the catch already passes on). The same cause was real for a
+  `throw` of a later command that takes the error through `2>&1`, which is
+  defect 10; the review withdrew the claim.
+- Three tests that take the error of a nested folder through `2>&1` relied
+  on the default error action and failed in the first frozen run, because
+  the CI wrappers set `$ErrorActionPreference` to `Stop`. The focused runner
+  of this work had not set it. It does now, and the tests name
+  `-ErrorAction Continue`.
+- With the runner at `Stop`, the mutation rounds at `d61dffa` showed that the
+  verbose and debug `throw` rows of the later-command tests ran without an
+  error action. Under `Stop`, the handler that reports the exception of the
+  later command as an item error ends the pipeline with it, and the row
+  cannot tell that from passing the exception on. Two mutations escaped (the
+  verbose record in two configurations, the debug record in all four). The
+  red evidence of defect 7 for these rows had been taken with the default
+  preference, so at CI they would not have been red. The rows now name
+  `-ErrorAction SilentlyContinue`, the rounds ran again, and the matrix above
+  shows these rows red before `40bf6a8` under a runner that sets `Stop`.
+- The first Init-script tests asserted only the state of the Backup
+  privilege. With the module setting `$true` the module enables the
+  privileges before the cmdlet runs, so the branch that the test names could
+  not fail it; the review predicted the mutation that then escaped (the
+  condition of that branch). The tests now also assert the verbose message
+  that only the cmdlet writes.
+- A test variable named `$forEach` is the automatic variable of `foreach`
+  and was empty inside Pester.
+- A `Get-Acl` precondition for the hard-link test failed in the elevated
+  configurations: the permissions were read despite the deny entries. The
+  claim about them was dropped instead of asserted.
+- Explanation rules that were wrong, or too strong, before they were
+  checked by probes and the review: a rule listed the `Extensions.ForEach`
+  and `GetParent` helpers as unused (the static scan does not see calls of
+  generic methods, which hid the callers of `ForEach`, and the rule did not
+  use the result of the scan for `GetParent`, which `Get-NTFSSimpleAccess`
+  calls), so both are tested directly now; the catch-all rule said that no
+  input could trigger it (a deny entry without rights does, and so does a
+  full ACL); the effective-access rule said that the library never throws
+  (the descriptor read is outside its try); the retry of the hash cmdlet
+  cannot be made to succeed with an OWNER RIGHTS entry, because Windows drops
+  it when the owner changes (probe); a dangling junction is read as the link
+  itself and triggers nothing (probe); a NULL DACL does reach the branch that
+  was called unreachable, and is tested; the hard-link rule said that no file
+  ACL is checked, which the probe shows only for the refused data.
+
+## Do the new tests detect faults?
+
+Bounded mutations change one statement of a frozen copy of the source, rebuild
+it, and run the guarding tests in the four configurations. A mutation is
+detected when its guard test fails. The source is restored exactly (the
+diff of the frozen copy is empty) and Release is rebuilt before any green
+validation. The mutations of a round are applied together only when no
+guard can fail because of another mutation of the round; the failures that
+no guard of the round names are listed in the logs and are the collateral of
+the mutations (for example, the `throw` rows next to the `Select-Object` rows
+that guard the same catch).
+
+Final rounds on the frozen source `5a5d58b`: 26 mutations in four rounds.
+Twenty-five are detected by their guard test in every configuration where
+that test runs (2 of 2 for the guards that need the privileges). The 26th,
+M25, is an equivalent mutant and survives as expected: with the check by type
+(`IsEnd`) removed from `IsFromLaterCommand`, the recording of the write
+methods still passes on every exception that a test can raise, so no test
+fails; the direct tests of `IsEnd` pin its rules (open item 9). The failures
+that no guard of a round names are the other tests of the mutated code: in
+round 3, the Init test for `$false` under M28, the privilege test that
+throws at the debug message under M26, and the audit test for the error
+category under M34. M25 has none.
+
+| Round | Mutation | File | Change | Guard | Detected |
+| ---: | --- | --- | --- | --- | --- |
+| 1 | M10 | `BaseCmdlets.cs` | `IsEnd` no longer recognizes a flow-control exception by the name of its base type | Should recognize an exception whose base type is the flow control exception of PowerShell | 4/4 |
+| 1 | M12 | `GetChildItem2.cs` | `[ValidateNotNull]` removed from `-Filter` | Should reject a null -Filter | 4/4 |
+| 1 | M13 | `SetSecurityDescriptor.cs` | the previous owner is not set back after a write that took ownership | Should set a previous owner back that the user can assign after the write that took ownership | 2/2 |
+| 1 | M14 | `FileSystemAccessRule2.RemoveFileSystemAccessRules.cs` | a deny entry is not removed from a descriptor | Remove-NTFSAccess should remove a deny entry from the descriptor and leave the item unchanged | 4/4 |
+| 1 | M16 | `SetSecurityDescriptor.cs` | the catch no longer passes on the exception of a later command | Set-NTFSSecurityDescriptor should stop at the verbose message for Select-Object -First 1 of the later command | 4/4 |
+| 1 | M17 | `GetFileHash2.cs` | the catch no longer passes on the exception of a later command | Get-FileHash2 should stop at the verbose message for Select-Object -First 1 of the later command | 4/4 |
+| 1 | M22 | `GetChildItem2.cs` | the second comparison of the name with the pattern is skipped | Should return only the items that match the whole pattern for -Filter *.*.* | 4/4 |
+| 1 | M23 | `BaseCmdlets.cs` | `WriteError` no longer records its exception | Should pass on what a later command throws when it takes the error of a nested folder | 4/4 |
+| 1 | M27 | `BaseCmdlets.cs` | `TryEnablePrivilege` no longer passes on the exception of a later command | Should pass on what a later command throws at the message after the enabling and disable the privileges | 2/2 |
+| 2 | M11 | `GetChildItem2.cs` | `*.*` is no longer treated as `*` | Should return every item for -Filter *.*, also the ones without a dot in their names | 4/4 |
+| 2 | M18 | `BaseCmdlets.cs` | `WriteObject` no longer records its exception | Copy-Item2 should stop for a terminating error (throw) of the later command | 4/4 |
+| 2 | M19 | `BaseCmdlets.cs` | `WriteVerbose` no longer records its exception | Get-FileHash2 should stop at the verbose message for throw of the later command | 4/4 |
+| 2 | M20 | `BaseCmdlets.cs` | `WriteDebug` no longer records its exception | Set-NTFSOwner should stop at the debug message for throw of the later command | 4/4 |
+| 2 | M7 | `GetChildItem2.cs` | the catch of the recursion no longer passes on the exception of a later command | Get-ChildItem2 should leave the loop for break after its first object | 4/4 |
+| 2 | M8 | `RemoveItem2.cs` | the catch no longer passes on the exception of a later command | Remove-Item2 should leave the loop for break after its first object | 4/4 |
+| 2 | M9 | `BaseCmdlets.cs` | `IsEnd` no longer recognizes `PipelineStoppedException` | Should recognize a PipelineStoppedException | 4/4 |
+| 3 | M25 | `BaseCmdlets.cs` | `IsFromLaterCommand` without the check by type (`IsEnd`) | none: expected to survive | 0/4, as expected |
+| 3 | M26 | `BaseCmdlets.cs` | `EnablePrivilege` notes the privilege after the debug message again | Should disable the privilege when Select-Object -First ends the pipeline at the message after its enabling | 2/2 |
+| 3 | M28 | `OtherCmdlets.cs` | `Enable-Privileges` in the Init script tests `EnablePrivileges == false` | Should enable the privileges when the module setting EnablePrivileges is $true | 2/2 |
+| 3 | M29 | `FileSystemAccessRule2.GetFileSystemAccessRules.cs` | the index guard of the `InheritedFrom` sources is removed | Should return the one entry that .NET reports for a NULL DACL, without a source | 4/4 |
+| 3 | M30 | `Extensions.cs` | `ForEach` accepts a null source | ForEach should reject a source that is null | 4/4 |
+| 3 | M31 | `Extensions.cs` | `GetParent` returns a `DirectoryInfo` for a parent path that names a file | Should return a parent path that names a file as a FileInfo of AlphaFS | 4/4 |
+| 3 | M32 | `AddAccess.cs` | the loop goes on to `-PassThru` after an `AddAceError` | Add-NTFSAccess, a deny entry without rights: Should write an AddAceError | 4/4 |
+| 3 | M33 | `RemoveAccess.cs` | another ID for the `RemoveAceError` | Remove-NTFSAccess, a deny entry without rights: Should write a RemoveAceError | 4/4 |
+| 3 | M34 | `AddAudit.cs` | another category for the `AddAceError` | Add-NTFSAudit, rights None: Should write an AddAceError | 2/2 |
+| 4 | M24 | `BaseCmdlets.cs` | `IsFromLaterCommand` is always false | Should leave the loop for a break of a later command that takes the error of a nested folder | 4/4 |
+
+Rounds at earlier commits found what these repeat. At `630926f`, nine of ten
+mutations were detected; the one that escaped, the second name comparison of
+`Get-ChildItem2`, exposed defect 5. At `ae3078f`, four more were detected. At
+`a50070a`, seven of nine were detected: M11 escaped because another mutation
+of the same round bypassed the same line (my overlap, so it moved to another
+round), and M21 was an equivalent mutant, an exception filter that no
+exception can reach, which `7aa8315` removed. At `d61dffa` the 26 mutations
+above ran once and three escaped: M19 and M20, because the verbose and debug
+rows ran under the error action of the CI runner, and M28, because the Init
+test could not fail for the branch it names. `f4a16e1` fixed the tests, and
+the rounds above ran again at the final source. Each round restored the
+source exactly (the diff of the frozen copy was empty) and rebuilt Release.
+
+## The remaining unvisited code
+
+The aggregate report leaves 231 methods with 442 unvisited sequence points
+and 70 unvisited explicit branch points; at `3442194` it left 918 sequence
+points. Every method is classified and none is unclassified: 223 are
+explained and 8 are open for the maintainer. The largest explained blocks
+are the 103 one-line getters of cmdlet parameters, the registry model that no
+cmdlet uses (105 points), the ownership retry of an audit write (47 points),
+the unused native handle wrappers (34 points), and the catch-all of the
+per-item loops (32 points).
+
+| Category | Disposition | Methods | Unvisited sequence points | Unvisited explicit branch points |
+| --- | --- | ---: | ---: | ---: |
+| unused by cmdlets | Explained | 60 | 173 | 34 |
+| parameter/API surface | Explained | 103 | 103 | 0 |
+| defensive | Explained | 33 | 77 | 16 |
+| environment-specific | Explained | 27 | 81 | 18 |
+| unused by cmdlets | Open | 8 | 8 | 2 |
+| **Total** | | **231** | **442** | **70** |
+
+The explanation of every rule is in
+[Quality-Gate-Paths-2026-10-09-Explanations.md](./Quality-Gate-Paths-2026-10-09-Explanations.md),
+each with its evidence (an executed probe, a static scan of the compiled
+code, or reading the source), its residual risk, and the tests that run the
+neighboring paths. [The method rows](./Quality-Gate-Paths-2026-10-09-Methods.csv)
+give, for every method, the source file, the unvisited lines, the number of
+unvisited sequence and branch points, whether a cmdlet reaches it in the
+compiled code, and its rule. "Explained" means a source-backed explanation
+exists, not that a test runs the path. The scan behind the column "reachable
+from a cmdlet" reads the compiled code and does not see calls of generic
+methods: it reported `Extensions.ForEach` as unreachable although cmdlets
+call it. Treat that column as a hint, not as evidence.
+
+## Per-cmdlet coverage
+
+[The cmdlet rows](./Quality-Gate-Paths-2026-10-09-Cmdlets.csv) give the
+sequence and branch points of each of the 36 cmdlets, including their
+closures. Every cmdlet has 72.5% or more of its sequence points visited. The
+lowest are `Clear-NTFSAudit` (72.5%), `Disable-NTFSAuditInheritance` and
+`Enable-NTFSAuditInheritance` (73.5%), `Add-NTFSAudit` (75.7%), and
+`Remove-NTFSAudit` (75.9%): their unvisited points are the retry after an
+access denial, which a local audit write never raises (rule
+AUDIT-OWNER-RETRY). `Get-NTFSSecurityDescriptor` (77.8%) has the catch-all of
+its loop and the closure of its owner retry, `Get-NTFSEffectiveAccess`
+(80.3%) the catch blocks around a library that hides its own failures, and
+`Get-NTFSInheritance` (80.9%) the catch and the retry of its loop.
+
+### Parameter sets
+
+The 36 cmdlets have 64 parameter sets, and 20 of the cmdlets have several:
+path or security descriptor, and for the four cmdlets that add and remove
+entries also simple or complex. Two kinds of evidence exist; neither is a
+matrix of judged error and state tests for each set.
+
+- A parser-based scan of the test files counts, for each set, the
+  invocations that can only bind it
+  ([the sets](./Quality-Gate-Paths-2026-10-09-ParameterSets.csv)). Fifty-seven
+  sets have at least one. Seven have none, because their tests splat the
+  parameters, pipe the descriptor, or call the command through a variable:
+  `Add-NTFSAudit` (SDSimple), `Get-NTFSOrphanedAudit` (SD), `Get-NTFSOwner`
+  (SecurityDescriptor), `Remove-NTFSAccess` (PathSimple and SDSimple), and
+  `Remove-NTFSAudit` (PathSimple and SDSimple).
+- No unvisited point lies on a parameter-set switch. The 20 cmdlets with
+  several sets have 168 unvisited points, 165 sequence points and 3 branch
+  points. Sixty-nine sequence points are property getters; the other 96
+  sequence points and 3 branch points are catch handlers with their closing
+  braces, their `WriteError` and `continue`, and the closures of the owner
+  retry. None of them mentions `ParameterSetName`, the descriptor list, or
+  `AppliesTo`.
+
+## Open items for the maintainer
+
+None of these was changed or reclassified as harmless.
+
+1. `FileSystemSecurity2` converts from `FileSecurity` and `DirectorySecurity`
+   through `FileInfo("")` and `DirectoryInfo("")`, so every conversion
+   throws. No cmdlet uses it; fix or remove it.
+2. `RemoveFileSystemAccessRuleAll` and `RemoveFileSystemAuditRuleAll` ignore
+   their account list and remove every explicit entry (finding #113). No
+   cmdlet passes an account list. The predicate of the discarded filter,
+   `Count() > 1`, would match no account that appears once, so using its
+   result as it stands would remove nothing.
+3. The overloads of `AddFileSystemAccessRule` and `AddFileSystemAuditRule`
+   for a path and several accounts are lazy iterators, so nothing is written
+   until the caller enumerates the result; the overloads for an item and for
+   a descriptor write at once.
+4. A `PrivilegeEnabler` that enabled a privilege and was never disposed
+   keeps the privilege enabled: a static list holds it, so its finalizer
+   never runs.
+5. `Get-ChildItem2 -Filter` matches names twice, in the AlphaFS enumeration
+   and in the cmdlet, and their rules for a dot differ from those of
+   `Get-ChildItem` (probe p32, both editions unless noted). `*.*` now means
+   every item, but `Report.*` does not return the file `Report` and `Rep*.`
+   returns nothing where `Get-ChildItem` returns `Report`; `Report.` returns
+   nothing, as in PowerShell 7 but not in Windows PowerShell 5.1, which
+   returns `Report`; an empty value returns nothing without an error. The
+   documentation lists this and `ItemCmdlets.Tests` pins it, so a change is a
+   decision. Decide whether to align the rules.
+6. The registry model, the unused helper classes, and the raw descriptor
+   readers have no caller (Decisions 21 and 22 govern them). Their
+   explanations say so; removing them is your decision.
+7. The ownership retry of an audit write over SMB has no test that a local
+   volume can run: a local audit write never fails with access denied. The
+   lab suite covers the cmdlets over SMB; gate 3 should repeat it.
+8. Seventeen handlers enclose only a helper that can write a
+   `RestoreOwnerError` (`InvokeAsOwner`, `WriteChangesAsOwner`) and do not
+   pass on what a later command raises at that write. By reading the code,
+   the handler then writes the error of the item, which raises again for
+   `-ErrorAction Stop` and for a stopped pipeline, so those still end the
+   command (not run); a later command that throws only for the
+   `RestoreOwnerError` record would have its exception swallowed. Closing it
+   means one check in each handler and a test with an owner that cannot be
+   set back (elevated only).
+9. The type check `PipelineControl.IsEnd` backs up the recording of the
+   write methods for calls into PowerShell that nothing records, for example
+   `ShouldProcess` in the try block of `Remove-Item2`. No test makes that
+   call raise it, and the mutation that removes it is not detected (round 3);
+   only direct tests of its type rules cover it. Keep it as defense in depth
+   or remove it.
+10. The catch of `Enable-Privileges` that rethrows a `ParseException` for a
+    malformed module setting is unvisited: the base class casts the same
+    value first.
+11. By reading the source, the `-SecurityDescriptor` sets of the four cmdlets
+    that add and remove entries have no handler around the change: an
+    exception, such as one for a deny entry without rights, ends the cmdlet
+    with a terminating error, where the `-Path` sets write an error for the
+    item and go on. The probe of a full ACL ran into it with
+    `-SecurityDescriptor`. The zero-mask tests use `-Path` only. Whether the
+    descriptor sets should report per item is a design decision.
+12. The test helpers `Add-TestDenyRule`, `Set-TestOwner`, and
+    `Block-TestReadPermission` and `Block-TestWritePermission` accept an
+    existing link as the item: the check of `Assert-TestSandboxPath` covers
+    the folders of the path, not the item. Only `Set-TestNullDacl` refuses a
+    link. No test passes a link to them.
+13. Decision 22 remains proposed, and the stable 5.0.0 gate stays open.
+
+## Completion matrix
+
+| Criterion of the handoff | Status | Evidence |
+| --- | --- | --- |
+| Every currently unvisited method is inventoried | Done | 231 methods in the CSV, none unclassified |
+| Each path is tested or has a source-backed explanation | Done, with open items | explanations by rule; 8 methods stay open for the maintainer |
+| Reachable gaps closed first, without duplicating earlier tests | Done | 136 new `It` blocks; defects 1 to 11 |
+| Behavior tests before production changes | Not evidenced | each of the eight fix commits carries its tests and its fix together, and the red runs that were taken while the tests were written were deleted with their run folders; the order cannot be shown from the history or from kept logs. The first test of defect 8 pinned `*.*` as the design and was changed after a review finding |
+| Regressions that fail without the fix | Done, with exceptions | the red/green matrix: 76 rows (73 in the basic configurations) fail at the base, each is green at the step of its fix, none breaks later; the mutations. Exceptions: defect 9 has no guard; the guards of defect 11 and the audit row of defect 3 run only elevated |
+| All cmdlets and parameter sets have meaningful error and state tests | Partly | per-cmdlet coverage of 72.5% or more; the parameter-set evidence is a parser count and the coverage of the switches, not a matrix of judged tests |
+| Full suite in both editions and privilege modes | Passed | 1,310 cases in each, zero failures |
+| No required case is skipped across the matrix | Passed | 578 skipped rows, each executed in two other configurations |
+| Frozen Release measurement with all four configurations | Done | source pin, XML, hashes, exclusions |
+| Differences from the `3442194` baseline explained | Done | the coverage section |
+| Self-review and one independent finished-diff review | Done, see the limits | the review section |
+| Docs, help, changelog, Memory Bank | Done | `CHANGELOG.md`, cmdlet page, help, Memory Bank |
+| Commit locally, no remote change | Done | the commits above; no push |
+
+## Checks not run, and limits
+
+- The lab suite, the published-package acceptance, and the OS matrix were not
+  run here; they belong to gate 3.
+- A matrix of error and state tests for each parameter set was not built.
+  The evidence is described under [Parameter sets](#parameter-sets): a
+  parser-based count of the test invocations and the coverage of the
+  parameter-set switches. It does not judge how meaningful each test is.
+- The explanations are not tests. Each one names its evidence; an
+  explanation that rests on reading the source only says so.
+- The custom `security-reviewer` agent could not start because of its
+  configured model, and no model setting was changed. The built-in read-only
+  `code-review` agent made the static review passes below; none of them built
+  or ran anything.
+- The coverage percentages are not a measure of the quality of the
+  assertions; the mutations are the measure for the new tests. A mutation
+  that is not detected is reported, not hidden.
+- The CI scripts set `$ErrorActionPreference` to `Stop`, and a test that
+  relies on a non-terminating error must name its error action. The tests
+  were checked for this by reading and by the mutation rounds, and the
+  focused runner of this work sets `Stop` too, but nothing enforces it: a new
+  row without an error action would regain the weakness silently. A test
+  that every `Run` block of `PipelineControl.Tests` names one is a possible
+  hardening that was not added.
+- The red/green matrix measures the final tests on older production code. It
+  does not show the order in which a test and its fix were written; the red
+  runs of that time were not kept. The ten states are identified by the
+  commit of their build, not by hashes of their assemblies.
+- All runs are on one Windows Server 2025 host. The privileged tests skip
+  without the privileges and run elevated, so a basic-user run cannot show
+  them; the eligibility check shows that each of them runs elsewhere.
+
+## Handoff to gate 3
+
+Repeat the affected acceptance on the packaged candidate before it is
+published. Each fix changes behavior that the lab can observe:
+
+| Fix | What to repeat |
+| --- | --- |
+| `c7a0383` | `Clear-NTFSAccess -DisableInheritance` and `Set-NTFSSecurityDescriptor` on an item that the user owns, over SMB: no `RestoreOwnerError` |
+| `2909a1c` | `Get-NTFSAccess` and `Get-NTFSAudit` with `GetInheritedFrom` for an item whose parent folder is unreadable |
+| `c77ecbf`, `40bf6a8`, `d44a200` | `Remove-Item2`, `Copy-Item2`, `Move-Item2`, `Set-NTFSOwner`, `Set-NTFSSecurityDescriptor`, and `Get-ChildItem2` with `Select-Object -First 1`, `break`, and a `throw` of a later command, also on the verbose, debug, and error streams: no further item changes, and the caller sees the error |
+| `d44a200` | `Get-NTFSOwner` or `Get-NTFSAccess` with the debug stream taken by `Select-Object -First 2`: the Take Ownership privilege is disabled again afterwards (elevated) |
+| `ee7c105`, `ae3078f`, `40bf6a8` | `Get-ChildItem2 -Filter` with brackets, `*.*`, and a null value on a share |
+| `b14c90b` | the rule, audit, and privilege objects in the packaged module |
+
+## Review
+
+The custom `security-reviewer` agent could not start because of its
+configured model, and no model setting was changed. A built-in read-only
+`code-review` agent made nine static passes: seven over the diff in ranges,
+which also read the draft appendix and the draft report; a read of the final
+report, the appendix, the tables, the Memory Bank notes, and the lab README;
+and a read of the red/green evidence against its raw logs. It built and ran
+nothing. No pass found a Blocker or a Major issue. Every finding was either
+fixed, turned into an open item, or answered with a probe; one finding
+(`-ErrorAction Stop` swallowed by the recursion) was refuted by a probe and
+withdrawn by the reviewer.
+
+| Pass | Range | Findings (Minor unless stated) | What became of them |
+| ---: | --- | --- | --- |
+| 1 | `f11ff41..cd56f49` | A break or continue test whose first output was above the recursion, so it never reached the frame where `Get-ChildItem2` swallowed both; tests that pinned the lazy path overloads as correct; a `PrivilegeEnabler` test without `finally`; three Nits | defect 4 for every cmdlet; open item 3; `finally` added |
+| 2 | `cd56f49..630926f` | No test for the sandbox guard of the drive-mapping helper; its drive letter collided with two tests; no `throw` or `-ErrorAction Stop` row, which the engine could deliver as another exception | guard tests, the free-letter choice, and the rows that found defect 7 |
+| 3 | `630926f..ae3078f` | `*.*` pinned as design; a restored-owner test that could pass without reaching the restore; the help dropped the asterisks of the `-Filter` paragraph; wording (Nit) | defect 8; a precondition in the test; the paragraph rewritten for platyPS |
+| 4 | `ae3078f..40bf6a8` and the first appendix | The recording of the write methods judged sound; gaps in how handlers were counted; eight rules doubted with evidence | handlers and rules corrected, the tests of this report added |
+| 5 | `40bf6a8..7aa8315` and the draft report | The draft described an older commit; the check by type had no behavior test; wording about "a later command" (Nits) | the report regenerated; reflection tests of the check by type; typed-throw rows |
+| 6 | `7aa8315..d0bd1af` | The dot paragraph named the wrong layer; Init tests that could not fail for their branch; the first-nested-folder assertion; a link as the item of `Set-TestNullDacl`; wording (Nits) | `f4a16e1` and `5a5d58b` |
+| 7 | `d0bd1af..5a5d58b` | A comment named three cmdlets where one calls `ShouldProcess` in a try block (Nit); optional: a test that every `Run` block names an error action | the comment fixed after the measured source; the guard test is not added (limits) |
+| 8 | the final report, appendix, tables, Memory Bank notes, lab README | Four Minor: the production total left out `ProcessPrivileges`; the red runs of the fixes were not preserved, and "six `throw` cases" could not be reproduced; the hard-link rule stated more than its evidence; the Memory Bank said that AlphaFS follows the Windows dot rules. Nine Nits: the dot rule that depends on the edition, the count of unvisited points, the helper callers, the warning codes, the completion row together with the "test-first" wording of the Memory Bank, the wording "no test can make that call raise it", the trigger of a full ACL, and two missing items (the test helpers that accept a link, and the dependence on the ambient error action) | the numbers and wording corrected; the red evidence measured again (the red/green matrix above); the rule and the Memory Bank corrected; open items 11 and 12 and the limit about the error action added |
+| 9 | the red/green section, its CSV, the completion row, the Memory Bank notes, against the 40 raw logs | Two Minor: the test file of defect 2 was named wrongly (PathErrors, not Access); the completion row said that tests came before the fixes, which no kept evidence shows. Four Nits: the focused runner was called the CI wrappers and its result an NUnit result; defect 7 read "a `throw` or a terminating error", where only the `throw` rows turn green with fix 7; one guard row fails without a message; the 40 logs had no fingerprint | the CSV has a test-file column and the step table follows it; the row is split into an order that is not evidenced and a guard that is measured; the wording corrected; the empty message explained by the source and the mutation M16; a manifest with the SHA-256 of every log |
+
+Pass 8 checked the identity paragraph, the pass and skip table, the skipped
+rows, the assembly and evidence hashes, the mutation table, the coverage and
+category numbers, and the parameter-set counts against git and the CSVs, and
+found them to agree; the production total was the one exception. Pass 9
+recomputed the step table, the sub-counts of the defects table, and the
+claims about the unexpanded name and about the production code after
+`d44a200` from the raw logs and git, and found them to agree; its findings
+are about the test file, the order of tests and fixes, and wording. The
+corrections that followed pass 9 were checked by the author and by no other
+pass. No pass is a substitute for the lab acceptance of gate 3.
+
+## Evidence outside git
+
+Raw evidence is local and not committed. It is in the session folder
+`C:\Users\install\.copilot\session-state\4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files\qg-paths`:
+the OpenCover XML of the four configurations and the aggregate, the NUnit
+results of the Validate runs, the unvisited-method and unvisited-point
+inventories, the per-row eligibility CSV files, the mutation logs, the logs of
+the red/green matrix (the focused run of each of the ten states in the four
+configurations), the probe scripts and their results, and the scripts that
+produce the tables.
+
+| File | SHA-256 |
+| --- | --- |
+| `coverage/coverage.xml` | `3EFAE43A574B62AB5DDC80022E52D28B8606E82F0BF9045BECB87B2ACBADB8D4` |
+| `coverage/elevated-Desktop.xml` | `1DA9DAE5D5CDA1EB19079CFD69137EAC3314B8B926AD0D33C90026F2DE894B7D` |
+| `coverage/basic-Desktop.xml` | `E43E7B457161E4C63A044215362694E5AB10AAE2AA3E057E459AD2033DA98462` |
+| `coverage/elevated-Core.xml` | `DE329D7E640BD3E4F6C2DCC9EBF2217EF5E0E7F38C114738D0591FEBEAAEDD94` |
+| `coverage/basic-Core.xml` | `55D167E4764A9EE5DA2EBBAE64C3E9776434D70144DD6C6A810DEA8890524AA6` |
+| `validate/elevated-Desktop.xml` | `0FC57455840153FBCBAB53A1AEBF6ABA02088C3A647CD4116CAE29E23F587AAE` |
+| `validate/basic-Desktop.xml` | `9E27622F9ED0A92948C6BF59DD46AEF8AB6D4BEBF45BEAE4B0DB2AFDDF5D3011` |
+| `validate/elevated-Core.xml` | `1B8A5DB7A4A9337AAB5E63011E4807CCCC1C43BF1E171ADF3E15BB312AEED80E` |
+| `validate/basic-Core.xml` | `BFA5D4BC57EBC36A108F465418D5567FF05A0E4BFBF2E7096E4F785CAC74E8C2` |
+| `inventory-5a5d58b/unvisited-methods.csv` | `F5B736EDF662C9C0E3DEBD4302EE6F7A59DF0623FDCC2A479ECCA4C89773F007` |
+| `inventory-5a5d58b/unvisited-points.csv` | `56AA0B5DDA67B45545CCCCEF41497CB300B54A487BAFB2CAA4EA4E0D024749A5` |
+| `classification-5a5d58b.csv` | `E2CD8700C5C8DFB52D33D6E6DB96E3EBD630D94CB4A4D224B1BD1C1F356CECB0` |
+| `eligibility-run-5a5d58b/skipped-rows.csv` | `AD584A885AB5C73B4E4CC7C3CF42CC92114C198E48ABE0D367BB001AB93E7489` |
+| `measured-assemblies-5a5d58b.csv` | `A8030B7AD00E2B4632C88C46C336DFBC4873383A021F6B446DA4CED6462DA51C` |
+| `mutations-5a5d58b-r1/mutation-results.csv` | `29D4E5EEC5FCCD91E8E2C1323C030A75691B5FA530C8345757729E9DCB58EC61` |
+| `mutations-5a5d58b-r2/mutation-results.csv` | `87EC131C64C6F3AD0F440C41FA8CF0F0618E7875AAB5EC7D6A1C647CF361C98E` |
+| `mutations-5a5d58b-r3/mutation-results.csv` | `05D7752A5C9B0DA5F5A3F35ED83C471FCEDDAE5EA967D557AA0AD334A02A244C` |
+| `mutations-5a5d58b-r4/mutation-results.csv` | `EB774D4621658DFA8B4390FFC6201F913E88A214FB2510B69A5B9F50D922B18D` |
+| `redgreen/redgreen-results.csv` | `C2327B991608489A85CC32CE17CC58F258348677EA31815F123D228AECBCB55A` |
+| `redgreen/redgreen-failed-rows.csv` | `5AA4E1514F75CEEAACD8206F3E8C7727C2E970E2D45E7D545FD51F02EF21ED1F` |
+| `redgreen/redgreen-guards.csv` (the CSV file of this folder with the red/green rows) | `D5D4720B2E6DA3619889C75DF3A2876E505FEED19BDD34695C92EF7421CD3558` |
+| `redgreen/redgreen-summary.csv` | `46987DE40D526A279871E5F1915CDC346C576B3E644E169A1E3C79B7181B9052` |
+| `redgreen/redgreen-log-manifest.csv` (the CSV file of this folder with the hash of each of the 40 logs) | `3E45ABFD850155F276DA5AF0E3FBEE83800D2C269DBB59B800042AC0080D4615` |
+| `redgreen/redgreen-verify.csv` | `717AB27434D35A59750C35DB8B33F548FC6F7F3E01353F3BC290629516735DF7` |
+| `redgreen/redgreen-driver.log` | `FCB9AE5980092BE97E362B2BE412CAE771C0EFB0CC326CBE814726A246D535EA` |

Tests/Lab/README.md

@@ -143,7 +143,10 @@ and record the evidence in this folder:
 
 Records: [5.0.0-rc6](Acceptance-2026-10-08-5.0.0-rc6.md),
 [5.0.0-rc7](Acceptance-2026-10-08-5.0.0-rc7.md), and
-[quality-gate follow-up](Acceptance-2026-10-09-quality-gate.md).
+[quality-gate follow-up](Acceptance-2026-10-09-quality-gate.md). The review
+of the code that no unit test visits, with the fixes that the lab has to
+repeat, is in
+[Tests/Coverage](../Coverage/Quality-Gate-Paths-2026-10-09.md).
 
 ## Files