chore(release): address the review of the release preparation

Keep the details of the pending repository settings out of the Memory
Bank, which is public. Replace the test for the one published version with a
list of the versions that the PowerShell Gallery has, which the release guide
now asks to maintain, and name the description test after its assertion.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -31,19 +31,25 @@ reply for each issue, and the open questions.
 - D7: Dependabot for `github-actions` only; AlphaFS 2.2.1 everywhere.
 - D8: the manifest `Description` and a version-neutral README.
 - D9: merged local branches deleted after the run.
+- 2026-10-05: the report's recommendations accepted. #5 and #82 ship in
+  5.0.0 as breaking changes; #34 for rc3 if a file server is available;
+  #41 and #90 after 5.0.0; Minor findings become issues; the `pwsh` crash
+  is watched in CI.
 
 ## Evidence
 
 - Every branch tip: Release build without new warnings (296 at the top,
   305 at the baseline), docs checks clean, package dry run passed.
-- Tests at the top branch: Windows PowerShell 405 passed, 26 skipped;
+- Tests at the top branch: Windows PowerShell 423 passed, 26 skipped;
-  PowerShell 7 376 passed, 55 skipped (431). The baseline had 268 tests.
+  PowerShell 7 394 passed, 55 skipped (449). The baseline had 268 tests.
 - Tests that need privileges skip on the workstation and run in CI only;
   the PR descriptions list them.
 - Reviews: one security review per PR; the Major findings were fixed in
-  the PR that had them (PR 1: 1, PR 2: 5, PR 4: 2, PR 6: 1).
+  the PR that had them (PR 1: 1, PR 2: 5, PR 4: 2, PR 6: 1, PR 7: 3,
+  PR 8: 2).
 
 ## Next step
 
-The maintainer reads the report, pushes the branches, opens and merges the
+The maintainer applies the repository settings, pushes the eight branches,
-PRs, tags `5.0.0-rc2`, and decides #5 (`Get-ChildItem2 -Attributes`).
+opens and merges the PRs in order, and tags `5.0.0-rc2` once CI on
+`master` is green.

.memory-bank/progress.md

@@ -31,11 +31,16 @@ version is still 4.2.6.
   package 5 fixed with regression tests, plus what the reviews found: a
   failed retry after taking ownership left the owner changed, and
   `-PassThru` wrote objects after a failed change or under `-WhatIf`.
-  Maintainer decisions D2 to D5 (Decision 13), the issues #3, #4, #74, #86,
+  Maintainer decisions D2 to D5 (Decision 13), the issues #3, #4, #17, #74,
-  and #88 fixed, the 37 open issues triaged, `Docs/FAQ.md`, Dependabot for
+  #86, and #88 fixed, the 37 open issues triaged, `Docs/FAQ.md`, Dependabot for
   the actions, and the prerelease label `rc2`. One security review per PR;
-  every Major finding fixed. Tests at the top branch: Windows PowerShell
+  every Major finding fixed.
-  405 passed, 26 skipped; PowerShell 7 376 passed, 55 skipped (431).
+- 2026-10-05, morning: the maintainer accepted the report's
+  recommendations. #5 (`Get-ChildItem2 -Attributes` matches any listed
+  attribute; an empty value is an error) and #82 (no `Size` alias) ship in
+  5.0.0 as breaking changes on `ai/issue-fixes`. Tests at the top branch:
+  Windows PowerShell 423 passed, 26 skipped; PowerShell 7 394 passed, 55
+  skipped (449).
 
 ## Stable capabilities
 
@@ -58,22 +63,22 @@ version is still 4.2.6.
    label, date `[Unreleased]` as `[5.0.0]`, tag `5.0.0` (steps in
    `Docs/Contributing/05-Releasing.md`; CI warns when the changelog date
    isn't the release day).
-3. Repository settings, proposed on 2026-10-04 (not yet agreed): the
+3. Repository settings: the hardening proposed on 2026-10-04 isn't applied
-   `powershell-gallery` environment has no protection rules and no
+   yet (checked 2026-10-05); the maintainer applies it before pushing the
-   deployment policy, so a workflow on any branch can use
+   stack. The details are with the maintainer, not in the repository.
-   `PSGALLERY_API_KEY` (`nyanhp` also has write access); `master` has no
+4. Open bugs from the triage: #34 and #67 (the write includes owner and
-   protection or ruleset; head branches aren't deleted on merge; the
+   group; `fix/#34` swallows every error) for rc3 if a file server to test
-   remote branches `fix/#34` and `test/transfer` aren't merged.
+   against is available; #41 (a drive root reads the device object) and #90
-4. Open bugs from the triage: #5 (`Get-ChildItem2 -Attributes` matches all
+   (a trailing space in a folder name) after 5.0.0. Enhancements: #22, #49,
-   attributes, `Get-ChildItem` any; needs a decision), #17 (an ACE with
+   #68, #77, #87.
-   `GenericAll` can't be removed), #34 and #67 (the write includes owner
+5. `pwsh` 7.6.1 crashed three times during test runs on the ARM64
-   and group; `fix/#34` swallows every error), #41 (a drive root reads the
+   workstation (x64 emulation) with an access violation in `coreclr.dll` or
-   device object), #82 (a `Size` member of other type data blocks the
+   `System.Management.Automation.dll`, without module frames; not
-   import), #90 (a trailing space in a folder name). Enhancements: #22,
+   reproducible on demand. Check whether CI on native x64 shows it.
-   #49, #68, #77, #87.
+6. Minor review findings that the PRs list but don't fix, for example
-5. Minor review findings that the PRs list but don't fix, for example
    `Copy-Item2 -WhatIf` reporting a destination conflict as an error, and
-   relative path forms that the `*-Item2` cmdlets resolve themselves.
+   relative path forms that the `*-Item2` cmdlets resolve themselves; the
-6. Optional for the maintainer: delete the AppVeyor project and revoke its
+   maintainer tracks the useful ones as issues.
+7. Optional for the maintainer: delete the AppVeyor project and revoke its
    GitHub authorization, restrict wiki editing to collaborators, and ask
    `Sup3rlativ3` to delete the Read the Docs project.

Docs/Contributing/05-Releasing.md

@@ -45,7 +45,9 @@ release notes for the version of the module manifest.
 
 1. Set the version and the `Prerelease` label, such as `rc1`, and make sure
    that the `[Unreleased]` section of `CHANGELOG.md` describes the changes.
-   Merge the change into `master`.
+   Add the version that the Gallery has now to `$publishedVersions` in
+   `Tests/Repository.Tests.ps1`, so that a test catches a version that is
+   reused. Merge the change into `master`.
 2. Tag the commit on `master` with the version and push the tag:
 
    ```powershell

Tests/Repository.Tests.ps1

@@ -87,14 +87,17 @@ Describe 'Release metadata' {
         }
     }
 
-    # Before 5.0.0-rc2, the description named Windows PowerShell, although the module supports PowerShell 7 as well.
+    # Before 5.0.0-rc2, the description said "Windows PowerShell Module", although the module supports PowerShell 7.
-    It 'Should describe the module without naming one PowerShell edition' {
+    It 'Should have the description that the PowerShell Gallery shows for the module' {
         $manifest.Description | Should -BeExactly 'PowerShell module for managing file and folder security on NTFS volumes'
     }
 
-    # The PowerShell Gallery doesn't accept a version twice, and CI published 5.0.0-rc1 on 2026-10-04.
+    # The PowerShell Gallery doesn't accept a version twice. Add every published version to this list
-    It 'Should not reuse the published version 5.0.0-rc1' {
+    # (Docs/Contributing/05-Releasing.md).
-        $version | Should -Not -Be '5.0.0-rc1'
+    It 'Should not reuse a version that the PowerShell Gallery already has' {
+        $publishedVersions = '4.0', '4.2.2', '4.2.3', '4.2.4', '4.2.5', '4.2.6', '5.0.0-rc1'
+
+        $publishedVersions | Should -Not -Contain $version
     }
 
     It 'Should not name a prerelease version in the README, which outlives the release' {