docs(coverage): record the lab acceptance of the fixed build and the state of Handoff 5

The report gets the section on the acceptance of the fixed build in the first
lab (both editions 245 passed, 0 failed, 1 skipped), the matching row of the
completion matrix, and the bullet of the summary. The Memory Bank carries the
Handoff 5 evidence, the coverage baselines and the live-coverage method.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -9,6 +9,18 @@ source: current task evidence
 
 ## Current focus
 
+State at 2026-10-10 22:00 UTC: Handoff 5 (the coverage unknowns) is done
+locally on `ai/coverage-unknowns`, from `origin/master` `6696f68`; nothing is
+pushed. The report is `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`
+with nine CSV tables. rc7 (`fa0701b`) was measured at 3,198/3,649 sequence
+points (87.64%); the live suite (first lab, three matrix cells) and the unit
+suite on a domain member add only 9 sequence and 4 explicit branch points, all
+of `fdd7a8b`. One defect is fixed (`419cfb3`, an identity compared with a name
+in `tr-TR`), 79 `It` blocks in four files are added (final commit `b2cb47b`:
+1,455 cases per configuration, 3,243 points), and a defect is open (hard-link
+names under a root that is not the volume root). The maintainer decides
+whether the fix and the tests enter a new candidate.
+
 State at 2026-10-10 15:45 UTC: the maintainer integrated the release-gate stack
 into `master` (`6dd799f`, CI green): #116 (rc7, `8a6be9f`), #120
 (`bdb9981`; it replaced #117, which GitHub closed unmerged when the branch
@@ -101,21 +113,21 @@ acceptance is the maintainer's.
   passed. A dry run of `Run-MatrixSequence.ps1 -Version 5.0.0-rc6` showed that
   the published-package path works. Labs at 07:50 UTC on 2026-10-10: no fixture
   or probe residue; `OSWin11E` shuts itself down an hour after its start.
-- Test coverage of the 5.0.0 code, assessed 2026-10-10 (nothing was changed).
-  Measured at `5a5d58b`: 87.84% of the sequence points (3,192 of 3,634) and
-  93.96% of the explicit branch points; every cmdlet is at 72.5% or more. Of
-  the 442 unvisited points, 181 are in code that no cmdlet calls, 103 are
-  parameter getters, 77 defensive, and 81 environment-specific (47 of them the
-  ownership retry of an audit write over SMB). Since then the production C#
-  changed by 70 inserted lines (`962887a`, `fdd7a8b`), so the ratios are off by
-  2 points at most. A parser scan finds all 36 cmdlets and all 147 documented
-  parameters in the unit tests (four only as keys of data-driven hashtables)
-  and 34 cmdlets in the live tests (not `Enable-Privileges`, `Get-DiskSpace`).
-  Not measured: the coverage of the live tests and of the suite on a domain
-  member, and of the code after the fixes. Not tested: Server Core, other
-  cultures, servers that aren't Windows (#34), and a judged test matrix per
-  parameter set (57 of 64 sets have a test call that binds them; the coverage
-  shows every switch visited).
+- Handoff 5, the coverage unknowns, 2026-10-10 (report
+  `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`; raw evidence in the
+  session folder `816cf47d-2f80-4eba-8ac9-41702c49560b\files\qg-unknowns`
+  with a hash manifest). rc7 measured at `fa0701b` (four frozen
+  configurations, AltCover): 3,198/3,649 sequence points (87.64%), 1,090/1,168
+  explicit branch points; 232 unvisited methods, all classified. Live suite on
+  an instrumented copy (first lab and three cells, counts equal to the
+  acceptance) and unit suite on `OSFile25`: together +9 sequence and +4
+  explicit branch points (the code of `fdd7a8b`); the cells add nothing to
+  the first lab; no test or probe reaches the audit ownership retry or the
+  audit read denial. The new tests add 45 points (getters of pipeline
+  parameters; the paths report was wrong that no caller invokes a getter);
+  7 of 64 parameter sets closed, 51 partly, 1 open, 4 left to the maintainer.
+  Cultures `de-DE` and `tr-TR`: one defect, fixed (`419cfb3`). Not tested:
+  Server Core (plan), ARM64, a localized system, non-Windows servers.
 - Raw evidence is outside git: the session folder
   `4b12e2f4-d4c7-4a5d-883a-ddb7421c4848\files` (`qg-paths`, the matrix runs, the
   night log) and
@@ -154,9 +166,11 @@ acceptance is the maintainer's.
    Modify; protecting them is a design change of the controller and needs a new
    acceptance). The help could also say that a local standard user who asks
    about a domain account still gets "Access is denied".
-6. The two measurement gaps (Evidence): measure the coverage at the tag again
-   with the method of the paths report (about 1.5 hours, local), and run the
-   live tests with an instrumented build to see what they add, the audit
-   ownership retry first (about 2 to 3 hours with the lab). Neither was
-   requested; the agent starts them on request.
+6. Handoff 5 is done (Evidence). The maintainer decides whether the fix
+   `419cfb3` and the tests enter a new candidate (rc8), which needs the matrix
+   cells and the first lab on its bytes, and he decides the open items of the
+   report: hard-link names under another root (a defect with a
+   reproduction), a piped `AppliesTo` property that doesn't select the Simple
+   set, 12 getters of pipeline parameters, the 52 partly closed sets, the audit
+   paths, Server Core (widens Decision 24), and ARM64.
 7. Do not release stable 5.0.0 or equate a percentage with gate closure.

.memory-bank/progress.md

@@ -99,6 +99,15 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
   9 245 / 0 / 1 per edition; every end state CLEAN. The counts equal those of
   the final local candidate. Record:
   `Tests/Lab/Acceptance-2026-10-10-published-rc7.md`.
+- 2026-10-10: Handoff 5, the coverage unknowns (local, `ai/coverage-unknowns`,
+  nothing pushed). rc7 measured at `fa0701b`: 3,198/3,649 sequence points;
+  the live suite and the suite on a domain member add 9 sequence and 4
+  explicit branch points (`fdd7a8b`); one defect fixed (`419cfb3`, `tr-TR`),
+  79 `It` blocks added (`b2cb47b`: 1,455 cases per configuration, 3,243
+  points); the getter rule of the paths report corrected; the first lab
+  accepted on the fixed build. Open: hard-link names under another root, a
+  piped `AppliesTo`, Server Core, ARM64. Report:
+  `Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md`.
 
 ## Stable capabilities
 
@@ -135,16 +144,18 @@ After 5.0.0, archive in favor of WindowsAccessControl (Decision 18).
 6. Optional maintainer cleanup: obsolete AppVeyor/Read the Docs access,
    wiki editing restrictions, `test/transfer`, and old lab checkpoints
    when no longer needed. No remote changes or snapshot restores here.
-7. Remaining-path inventory at the final frozen commit of Handoff 1:
-   442 unvisited sequence points in 231 methods, all classified
-   (`Tests/Coverage`): 223 explained from source with evidence, 8 open
-   (`FileSecurity` conversions, `RemoveAll` account filters). Other open
-   decisions: lazy path overloads, abandoned `PrivilegeEnabler`, dot patterns
-   of `Get-ChildItem2 -Filter`, 17 owner-restore handlers that do not pass on
+7. Remaining-path inventory at the final frozen commit of Handoff 5
+   (`b2cb47b`): 406 unvisited sequence points in 187 methods, all classified
+   (`Tests/Coverage`): 167 explained from source with evidence, 20 open (8:
+   `FileSecurity` conversions, `RemoveAll` account filters; 12 getters of
+   pipeline parameters that no test binds by property name). Other open
+   decisions: lazy path overloads, abandoned
+   `PrivilegeEnabler`, dot patterns of `Get-ChildItem2 -Filter`, 17
+   owner-restore handlers that do not pass on
    what a later command raises (a rare combination), unused classes. An audit
-   write's ownership retry cannot run on a local volume and is covered only
-   by the lab. A conditional ACE display remains a .NET representation limit,
-   not evidence of unconditional permissions.
+   write's ownership retry cannot run on a local volume or on a Windows file
+   server (probe) and no test reaches it. A conditional ACE display remains a
+   .NET representation limit, not evidence of unconditional permissions.
 8. Publication recovery (`95b827e`, merged in #120): 14 offline tests and exact
    artifact SHA-512 verification; the original upload errors remain errors for
    missing, different, or unverifiable outcomes. The agent published nothing,

.memory-bank/techContext.md

@@ -105,35 +105,40 @@ source: repository and executable evidence
   four configurations sequentially with the real CI wrappers, then
   AltCover runner --collect recalculates the report. Compute option paths
   before passing native arguments, not inline Join-Path expressions.
-- Report sequence points, not unique source lines. Four-run baselines: rc5
-  2,020/3,476 (58.1%); rc6 2,412/3,540 (68.14%); `3442194` 2,641/3,559
-  (74.21%); `5a5d58b` 3,192/3,634 (87.84%), branches 1,273/1,978 (64.36%).
-  The code changes the denominators: never present these as same-source
-  increments. The branch summary counts 820 compiler-generated points; report
-  the explicit branch points too (1,088/1,158, 93.96%). Suite at `5a5d58b`:
-  1,310 per configuration, zero failures (skipped: 24 and 55 elevated, 234
-  and 265 basic, Desktop and Core).
+- Report sequence points, not unique source lines. Four-run baselines:
+  `3442194` 2,641/3,559 (74.21%); `5a5d58b` 3,192/3,634 (87.84%); `fa0701b`
+  (rc7) 3,198/3,649 (87.64%); `b2cb47b` 3,243/3,649 (88.87%). The code
+  changes the denominators: never present these as same-source increments.
+  The branch summary counts 821 compiler-generated points; report the
+  explicit branch points too (1,090/1,168, 93.32%). Suite at `b2cb47b`: 1,455
+  per configuration, zero failures (skipped: 26 and 57 elevated, 276 and 307
+  basic, Desktop and Core).
 - NUnit skipped ForEach names retain placeholders and parameter tuples,
   executed names expand them: raw-name intersection and positional alignment
   are invalid. Check skip eligibility by row: run the suite once per
   configuration with Pester PassThru and match skipped with executed rows by
   file, line, path, name, and data (discovery alone misses tests that skip
   while running; write primitives, as `ConvertTo-Json` of rich rows hangs).
-- Remaining inventory: 442 points in 231 methods, classified by rule with
-  evidence (probe, IL scan, source reading); see `Tests/Coverage`. Preserve
-  raw XML, row CSVs, logs, commit identity, and build hashes: the frozen
-  Build rewrites its hash file, so save the hashes of the measured assemblies
-  (AltCover `__Saved` copies) before any mutation build.
-- Bounded mutations: one script per round on the frozen worktree, with guards
-  that no other mutation of the round can trip (an escape can be an overlap
-  or an equivalent mutant: check before changing a test). Restore the source
-  exactly and rebuild.
-- Red/green matrix (a guard fails without its fix): build each state of the
-  branch in its own Release worktree, lay the final `Tests` over it, run the
-  guarding files with the focused runner in all four configurations, and count
-  failed rows per name with multiplicity; the last state is the control. Keep
-  the logs, a manifest with hashes, and the hash of each build: the first red
-  runs of Handoff 1 were deleted and could not be reproduced.
+- Live and domain-member coverage: instrument a copy of the package without
+  `--portable`, with an absolute report path outside the payload
+  (`C:\NtfsMatrixProbe\Coverage`, `icacls` Authenticated Users modify) and a
+  SYSTEM task that snapshots the report after each process (a role that is not
+  an administrator of the client can't write next to the module). It counts
+  only when its counts equal the uninstrumented acceptance and every role
+  logged a flush. Merge by position, never by `uspid`. PowerShell reads the
+  getter of a parameter that it binds from a piped object: unvisited getters
+  point at missing pipeline tests.
+- Remaining inventory at `b2cb47b`: 406 points in 187 methods, classified by
+  rule (`Tests/Coverage`). Preserve raw XML, row CSVs, logs, commit identity,
+  and build hashes: the frozen Build rewrites its hash file, so save the
+  hashes of the measured assemblies (AltCover `__Saved` copies) first.
+- Mutation proofs: bounded one-statement changes on a second frozen worktree,
+  source restored exactly and rebuilt (an escape can be an overlap, an
+  equivalent mutant, or a masked case: check before changing a test). Red/green
+  matrix for a fix: build each state in its own Release worktree, lay the
+  final `Tests` over it, count failed rows per name in all four
+  configurations, and keep logs and hashes (Handoff 1's first red runs were
+  deleted and could not be reproduced).
 
 ## Lab acceptance
 

Tests/Coverage/Quality-Gate-Unknowns-2026-10-10.md

@@ -33,7 +33,8 @@ is open.
   the suite has 1,455 cases per configuration without a failure and covers
   3,243 sequence points (88.87%).
 - **A defect fixed, a defect open.** The comparison of an identity with a name
-  was wrong in `tr-TR`; it is fixed test-first (`419cfb3`). The hard-link
+  was wrong in `tr-TR`; it is fixed test-first (`419cfb3`), and the first lab
+  passes on the fixed build (245 passed, 1 skipped per edition). The hard-link
   cmdlets (`New-NTFSHardLink -PassThru`, `Get-NTFSHardLink`) fail for a path
   whose root is not the volume root; the defect is reproduced and left to the
   maintainer.
@@ -926,6 +927,39 @@ points, and 78 explicit branch points; each of the 187 is classified (none is
 unclassified), 167 as explained and 20 as open (the 8 methods that the paths
 report left to the maintainer, and 12 getters of pipeline parameters).
 
+## Lab acceptance of the fixed build
+
+A defect that is not an open item is fixed, and the lab acceptance of the
+affected behavior is repeated on the fixed build (the handoff, as the paths
+work did). The affected behavior is the comparison of an identity with a name.
+No cmdlet uses it (the cmdlets compare identities by SID, and no line of the C#
+of the cmdlets compares an identity with a string) and no live test does, so
+this run is evidence that the fix changes nothing in the lab. It is not a
+release acceptance: a new candidate needs its own (open item 6).
+
+- Module: the extracted package of the measured final build
+  (`E\final\package\NTFSSecurity`, packaged like CI by `New-ModulePackage.ps1`
+  from the pristine copy). The hashes of its four assemblies, logged at the
+  start of the run, are those of the final measurement. It was passed with
+  `-ModulePath` to the unmodified controller and live tests of the repository
+  (Git blobs `635bf162…` and `efe36e50…`), without instrumentation.
+- Lab: `WindowsAccessControlLab` (client `F1AFile1`, file server `F1AFile2`,
+  four domains, the trusts), one call per edition, run `fix1`,
+  `Run-LiveAcceptance.ps1`.
+
+| Role | Account | Passed | Failed | Skipped | Exit code |
+| --- | --- | ---: | ---: | ---: | ---: |
+| Delegate | `A\NtfsLiveDelegate` | 69 | 0 | 0 | 0 |
+| ServerAdmin | `A\NtfsLiveServerAdmin` | 36 | 0 | 0 | 0 |
+| Admin | `A\NtfsLiveAdmin` | 64 | 0 | 0 | 0 |
+| Server | `A\install` | 76 | 0 | 1 | 0 |
+
+Both editions gave the same counts: 245 passed, 0 failed, 1 skipped
+(`LIVE_RESULT_VERIFIED`), the counts of the rc7 acceptance and of the
+instrumented runs. The removal of the fixture and the independent check of the
+end state found no account, share, folder, profile, task, or group member left
+in the four domains and on both machines (`CLEAN`, 21:30:18Z).
+
 ## Decisions made
 
 The decisions below are the agent's, taken inside the limits of the handoff;
@@ -1032,7 +1066,7 @@ of the effective-access check, Decisions 22 and 24, and #34) stay as they are.
 | Windows Server Core | Open | a plan with the image index, disk, time, and commands; deploying needs the maintainer's word |
 | ARM64 | Open | no reproduction |
 | The final commit | Closed | `b2cb47b`: 1,455 cases per configuration, no failure; 3,243/3,649 sequence points (88.87%); eligibility by row; 187 unvisited methods classified |
-| The lab acceptance of the fixed build | see the section below | the first lab, both editions, with the package of the measured bytes |
+| The lab acceptance of the fixed build | Closed for the first lab | the measured final package, both editions, 245 passed, 0 failed, 1 skipped each, clean end state; the matrix cells were not repeated (a new candidate needs them) |
 
 ## Checks not run, and limits