chore(release): address the review of the release preparation

Keep the details of the pending repository settings out of the Memory
Bank, which is public. Replace the test for the one published version with a
list of the versions that the PowerShell Gallery has, which the release guide
now asks to maintain, and name the description test after its assertion.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -31,19 +31,25 @@ reply for each issue, and the open questions.
 - D7: Dependabot for `github-actions` only; AlphaFS 2.2.1 everywhere.
 - D8: the manifest `Description` and a version-neutral README.
 - D9: merged local branches deleted after the run.
+- 2026-10-05: the report's recommendations accepted. #5 and #82 ship in
+  5.0.0 as breaking changes; #34 for rc3 if a file server is available;
+  #41 and #90 after 5.0.0; Minor findings become issues; the `pwsh` crash
+  is watched in CI.
 
 ## Evidence
 
 - Every branch tip: Release build without new warnings (296 at the top,
   305 at the baseline), docs checks clean, package dry run passed.
-- Tests at the top branch: Windows PowerShell 405 passed, 26 skipped;
-  PowerShell 7 376 passed, 55 skipped (431). The baseline had 268 tests.
+- Tests at the top branch: Windows PowerShell 423 passed, 26 skipped;
+  PowerShell 7 394 passed, 55 skipped (449). The baseline had 268 tests.
 - Tests that need privileges skip on the workstation and run in CI only;
   the PR descriptions list them.
 - Reviews: one security review per PR; the Major findings were fixed in
-  the PR that had them (PR 1: 1, PR 2: 5, PR 4: 2, PR 6: 1).
+  the PR that had them (PR 1: 1, PR 2: 5, PR 4: 2, PR 6: 1, PR 7: 3,
+  PR 8: 2).
 
 ## Next step
 
-The maintainer reads the report, pushes the branches, opens and merges the
-PRs, tags `5.0.0-rc2`, and decides #5 (`Get-ChildItem2 -Attributes`).
+The maintainer applies the repository settings, pushes the eight branches,
+opens and merges the PRs in order, and tags `5.0.0-rc2` once CI on
+`master` is green.

.memory-bank/progress.md

@@ -31,11 +31,16 @@ version is still 4.2.6.
   package 5 fixed with regression tests, plus what the reviews found: a
   failed retry after taking ownership left the owner changed, and
   `-PassThru` wrote objects after a failed change or under `-WhatIf`.
-  Maintainer decisions D2 to D5 (Decision 13), the issues #3, #4, #74, #86,
-  and #88 fixed, the 37 open issues triaged, `Docs/FAQ.md`, Dependabot for
+  Maintainer decisions D2 to D5 (Decision 13), the issues #3, #4, #17, #74,
+  #86, and #88 fixed, the 37 open issues triaged, `Docs/FAQ.md`, Dependabot for
   the actions, and the prerelease label `rc2`. One security review per PR;
-  every Major finding fixed. Tests at the top branch: Windows PowerShell
-  405 passed, 26 skipped; PowerShell 7 376 passed, 55 skipped (431).
+  every Major finding fixed.
+- 2026-10-05, morning: the maintainer accepted the report's
+  recommendations. #5 (`Get-ChildItem2 -Attributes` matches any listed
+  attribute; an empty value is an error) and #82 (no `Size` alias) ship in
+  5.0.0 as breaking changes on `ai/issue-fixes`. Tests at the top branch:
+  Windows PowerShell 423 passed, 26 skipped; PowerShell 7 394 passed, 55
+  skipped (449).
 
 ## Stable capabilities
 
@@ -58,22 +63,22 @@ version is still 4.2.6.
    label, date `[Unreleased]` as `[5.0.0]`, tag `5.0.0` (steps in
    `Docs/Contributing/05-Releasing.md`; CI warns when the changelog date
    isn't the release day).
-3. Repository settings, proposed on 2026-10-04 (not yet agreed): the
-   `powershell-gallery` environment has no protection rules and no
-   deployment policy, so a workflow on any branch can use
-   `PSGALLERY_API_KEY` (`nyanhp` also has write access); `master` has no
-   protection or ruleset; head branches aren't deleted on merge; the
-   remote branches `fix/#34` and `test/transfer` aren't merged.
-4. Open bugs from the triage: #5 (`Get-ChildItem2 -Attributes` matches all
-   attributes, `Get-ChildItem` any; needs a decision), #17 (an ACE with
-   `GenericAll` can't be removed), #34 and #67 (the write includes owner
-   and group; `fix/#34` swallows every error), #41 (a drive root reads the
-   device object), #82 (a `Size` member of other type data blocks the
-   import), #90 (a trailing space in a folder name). Enhancements: #22,
-   #49, #68, #77, #87.
-5. Minor review findings that the PRs list but don't fix, for example
+3. Repository settings: the hardening proposed on 2026-10-04 isn't applied
+   yet (checked 2026-10-05); the maintainer applies it before pushing the
+   stack. The details are with the maintainer, not in the repository.
+4. Open bugs from the triage: #34 and #67 (the write includes owner and
+   group; `fix/#34` swallows every error) for rc3 if a file server to test
+   against is available; #41 (a drive root reads the device object) and #90
+   (a trailing space in a folder name) after 5.0.0. Enhancements: #22, #49,
+   #68, #77, #87.
+5. `pwsh` 7.6.1 crashed three times during test runs on the ARM64
+   workstation (x64 emulation) with an access violation in `coreclr.dll` or
+   `System.Management.Automation.dll`, without module frames; not
+   reproducible on demand. Check whether CI on native x64 shows it.
+6. Minor review findings that the PRs list but don't fix, for example
    `Copy-Item2 -WhatIf` reporting a destination conflict as an error, and
-   relative path forms that the `*-Item2` cmdlets resolve themselves.
-6. Optional for the maintainer: delete the AppVeyor project and revoke its
+   relative path forms that the `*-Item2` cmdlets resolve themselves; the
+   maintainer tracks the useful ones as issues.
+7. Optional for the maintainer: delete the AppVeyor project and revoke its
    GitHub authorization, restrict wiki editing to collaborators, and ask
    `Sup3rlativ3` to delete the Read the Docs project.

Docs/Contributing/05-Releasing.md

@@ -45,7 +45,9 @@ release notes for the version of the module manifest.
 
 1. Set the version and the `Prerelease` label, such as `rc1`, and make sure
    that the `[Unreleased]` section of `CHANGELOG.md` describes the changes.
-   Merge the change into `master`.
+   Add the version that the Gallery has now to `$publishedVersions` in
+   `Tests/Repository.Tests.ps1`, so that a test catches a version that is
+   reused. Merge the change into `master`.
 2. Tag the commit on `master` with the version and push the tag:
 
    ```powershell

Tests/Repository.Tests.ps1

@@ -87,18 +87,21 @@ Describe 'Release metadata' {
         }
     }
 
-    # Before 5.0.0-rc2, the description named Windows PowerShell, although the module supports PowerShell 7 as well.
-    It 'Should describe the module without naming one PowerShell edition' {
+    # Before 5.0.0-rc2, the description said "Windows PowerShell Module", although the module supports PowerShell 7.
+    It 'Should have the description that the PowerShell Gallery shows for the module' {
         $manifest.Description | Should -BeExactly 'PowerShell module for managing file and folder security on NTFS volumes'
     }
 
-    # The PowerShell Gallery doesn't accept a version twice, and CI published 5.0.0-rc1 on 2026-10-04.
-    It 'Should not reuse the published version 5.0.0-rc1' {
-        $version | Should -Not -Be '5.0.0-rc1'
+    # The PowerShell Gallery doesn't accept a version twice. Add every published version to this list
+    # (Docs/Contributing/05-Releasing.md).
+    It 'Should not reuse a version that the PowerShell Gallery already has' {
+        $publishedVersions = '4.0', '4.2.2', '4.2.3', '4.2.4', '4.2.5', '4.2.6', '5.0.0-rc1'
+
+        $publishedVersions | Should -Not -Contain $version
     }
 
     It 'Should not name a prerelease version in the README, which outlives the release' {
         Get-Content -LiteralPath (Join-Path -Path $repositoryPath -ChildPath 'Docs\README.md') -Raw |
             Should -Not -Match '\d+\.\d+\.\d+-[A-Za-z]'
     }
-}
+}