chore(memory-bank): record work package 4 and Decision 10

- Decision 10: one version for the manifest, the first-party
  assemblies, and the changelog.
- Work packages 3 and 4 PR-ready; release checklist for 5.0.0.
- RootModule in the architecture; the new test files and what they
  guard.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -9,11 +9,12 @@ source: current task evidence
 
 ## Current focus
 
-Work package 3 was redefined by the maintainer: no Read the Docs, the docs
-stay on GitHub, and the wiki is retired (Decision 9). It is PR-ready on the
-local branch `ai/docs-on-github` (`84328dc` plus Memory Bank notes). Work
-package 4 (manifest and version) continues next, stacked on it, with the
-maintainer's decisions recorded in `progress.md`.
+Work packages 3 and 4 are PR-ready and committed locally, not pushed:
+`ai/docs-on-github` (docs on GitHub, wiki retired, Decision 9) and
+`ai/manifest-version` (valid manifest, version 5.0.0, Decision 10),
+stacked on it. The maintainer pushes both and opens the PRs; the PR
+descriptions are in the session files. Merge the docs PR first with a
+merge commit.
 
 ## Evidence
 
@@ -30,8 +31,15 @@ maintainer's decisions recorded in `progress.md`.
   (2019-07-12), whose notes were reconstructed from `4.2.4..4.2.6`.
 - The local branch `ai/read-the-docs` keeps the dropped strict-build work
   (`886c874`, `325ec76`); delete it once it is no longer wanted.
+- Work package 4 test first: against the previous build, all 10 new tests
+  failed for the expected reasons; after the change, the AppVeyor test
+  script run locally in Windows PowerShell 5.1 passed (228 of 228 Pester
+  tests), and the new tests pass in PowerShell 7.6.1 (10 of 10).
+- The local Release build (`packages\`, `bin\`, `obj\`) is deleted after
+  the work; rebuild from the NuGet cache (`techContext.md`).
 
 ## Next step
 
-Ask which assemblies follow the module version, then implement work
-package 4 test-first on a branch stacked on `ai/docs-on-github`.
+After the maintainer pushes: read the AppVeyor results of both PRs through
+the REST API. Work package 5 (code defects) starts only after the
+maintainer's go-ahead.

.memory-bank/decisions/0010-one-version.md

@@ -0,0 +1,24 @@
+---
+status: accepted
+date: 2026-10-04
+last-verified: 2026-10-04
+owner: shared
+source: maintainer decisions in work package 4
+---
+
+# Decision 10: One version for the manifest, assemblies, and changelog
+
+- Choice: `ModuleVersion` in `NTFSSecurity.psd1`, `AssemblyVersion` and
+  `AssemblyFileVersion` of `NTFSSecurity`, `Security2`, and
+  `PrivilegeControl` (as `x.y.z.0`), and the latest version section of
+  `CHANGELOG.md` carry the same version. The vendored `ProcessPrivileges`
+  and the unshipped `Log` keep their own versions.
+  `Tests\Manifest.Tests.ps1` enforces this.
+- Rationale: Before, the manifest said 4.2.5, the release 4.2.6, and the
+  assemblies 4.2.1.0, 3.2.3.0, and 1.0.0.0; releases bumped the version
+  only in the published copy. One version, set in the repository before
+  the release, identifies a build.
+- Consequence: A version bump changes all five places in one commit. The
+  date of the version section is the release date; update it when you tag.
+- Context: 5.0.0 is major because the minimum PowerShell version rose to
+  5.1. `Remove-Item2 -PassThur` stays as a deprecated alias of `-PassThru`.

.memory-bank/progress.md

@@ -13,7 +13,8 @@ PRs #91, #92, and #93 are merged. The documentation matches the cmdlets at
 `master`, and the module ships the help file generated from it
 (`en-US\NTFSSecurity.dll-Help.xml`). Otherwise the module source differs
 from the 4.2.6 release only by the `Remove-Item2 -PassThru` rename and
-`CompatiblePSEditions`.
+`CompatiblePSEditions`. Work packages 3 (`ai/docs-on-github`) and 4
+(`ai/manifest-version`, stacked on 3) are PR-ready locally.
 
 ## Recent milestones
 
@@ -38,6 +39,13 @@ from the 4.2.6 release only by the `Remove-Item2 -PassThru` rename and
   and the wiki is retired (Decision 9). Work package 3 committed locally on
   `ai/docs-on-github` (`84328dc`). The strict Read the Docs build prepared
   before stays unmerged on the local branch `ai/read-the-docs`.
+- 2026-10-04: Work package 4 committed locally on `ai/manifest-version`
+  (`678ff90`), stacked on `ai/docs-on-github`: valid manifest (requires
+  PowerShell 5.1), 36 cmdlets, version 5.0.0 everywhere (Decision 10),
+  `-PassThur` alias. The AppVeyor test script, run locally in Windows
+  PowerShell 5.1, passed: no docs drift, 0 broken links, current help file,
+  228 of 228 Pester tests. `Test-ModuleManifest` passes in Windows
+  PowerShell 5.1 and PowerShell 7.6.1.
 
 ## Stable capabilities
 
@@ -63,28 +71,19 @@ next package starts only after the maintainer's go-ahead.
    guide updated. After the merge, the maintainer turns the wiki off, points
    the notes of releases 4.2.4 and 4.2.6 to `Docs/Version-History.md`, and
    may ask `Sup3rlativ3` to delete the Read the Docs project.
-4. Manifest and version, in progress, stacked on `ai/docs-on-github`.
+4. Manifest and version, PR-ready on `ai/manifest-version`, stacked on
+   `ai/docs-on-github` (merge that PR first with a merge commit).
    Maintainer decisions: `PowerShellVersion` 5.1, `DotNetFrameworkVersion`
-   4.5.2, `RootModule` instead of `ModuleToProcess`; version 5.0.0 with
-   `[Alias('PassThur')]` on `Remove-Item2 -PassThru` (the changelog lists
-   `-PassThur` under Deprecated); the changelog entry about the
-   documentation site is gone (work package 3). Open: which assemblies
-   follow the module version. Remove `Show-NTFSSimpleAccess` and the
-   duplicate inheritance entries from `CmdletsToExport` (exactly 36
-   cmdlets exported), move the `[Unreleased]` entries into the 5.0.0
-   section, and align `AssemblyInfo`. No tag or publish. Done when
-   `Test-ModuleManifest` passes in Windows PowerShell 5.1 and PowerShell 7,
-   36 cmdlets are exported, the versions agree, and CI is green.
-   Baseline: `Test-ModuleManifest` fails in both editions
-   (`CompatiblePSEditions` needs `PowerShellVersion` 5.1) and warns about
-   `ModuleToProcess`; 41 `CmdletsToExport` entries, 37 unique; versions:
-   manifest 4.2.5, `NTFSSecurity` 4.2.1.0, `Security2` 3.2.3.0,
-   `PrivilegeControl` 1.0.0.0, `ProcessPrivileges` 1.5.7.0 (vendored);
-   `Log` isn't shipped. Releases are Debug builds published with the whole
-   output folder (`.pdb`, `.xml`, `System.Management.Automation.dll`), which
-   `FileList` doesn't list. Before the next build and `Publish-Module`,
-   clean `C:\Program Files\WindowsPowerShell\Modules\NTFSSecurity`, or the
-   removed `NTFSSecurity-Help.xml` ships again.
+   4.5.2, `RootModule`; version 5.0.0; `[Alias('PassThur')]` on
+   `Remove-Item2 -PassThru`, listed under Deprecated; `NTFSSecurity`,
+   `Security2`, and `PrivilegeControl` carry the module version (Decision
+   10). Before the release, not part of the PR: set the date of the 5.0.0
+   section to the release date, tag `5.0.0` (no `v` prefix), build in
+   Release, and clean `C:\Program Files\WindowsPowerShell\Modules\NTFSSecurity`
+   before `Publish-Module`; releases so far were Debug builds published with
+   the whole output folder (`.pdb`, `.xml`,
+   `System.Management.Automation.dll`), and the removed
+   `NTFSSecurity-Help.xml` would ship again.
 5. Code defects, listed below: `review: on`, one PR per group, regression
    test first. Pester 5 tests import `NTFSSecurity\bin\Release`, run in a
    `$env:TEMP` sandbox and in `appveyor.yml` (pattern:

.memory-bank/systemPatterns.md

@@ -17,7 +17,7 @@ NTFSSecurity.psd1 ─┬─ ScriptsToProcess: NTFSSecurity.Init.ps1
                    ├─ TypesToProcess: NTFSSecurity.types.ps1xml
                    │    (Owner, IsInheritanceBlocked, LengthOnDisk on
                    │    FileInfo/DirectoryInfo; AccountType on ACEs)
-                   ├─ ModuleToProcess: NTFSSecurity.psm1 (aliases)
+                   ├─ RootModule: NTFSSecurity.psm1 (aliases)
                    ├─ NestedModules: NTFSSecurity.dll (36 cmdlets)
                    └─ en-US\NTFSSecurity.dll-Help.xml (Get-Help; generated
                         from Docs/Cmdlets, Decision 8)
@@ -56,6 +56,7 @@ Each Decision record is a file in `decisions/`; read only the relevant ones.
 | 7 | [CHANGELOG lists user-visible changes only](decisions/0007-changelog-user-visible-only.md) |
 | 8 | [Commit the generated help file and check it in CI](decisions/0008-commit-generated-help.md) |
 | 9 | [Keep the documentation on GitHub](decisions/0009-docs-on-github.md) |
+| 10 | [One version for the manifest, assemblies, and changelog](decisions/0010-one-version.md) |
 
 ## Patterns
 
@@ -86,3 +87,7 @@ Each Decision record is a file in `decisions/`; read only the relevant ones.
 - Report Pester 5 results to AppVeyor through the build worker API, not as
   an uploaded NUnit file: the NUnit import files each test under every
   enclosing block (870 entries for 218 tests in build 54834154).
+- `Tests\Manifest.Tests.ps1` checks the built manifest: `Test-ModuleManifest`
+  without errors or warnings, exactly 36 cmdlets, and one version
+  (Decision 10). Add a new cmdlet to `CmdletsToExport` and to the expected
+  count in the same change.

.memory-bank/techContext.md

@@ -24,8 +24,10 @@ source: repository evidence
   0.14 markdown (schema 2.0.0) in `Docs/Cmdlets`.
 - Help: `NTFSSecurity\en-US\NTFSSecurity.dll-Help.xml`, generated from
   `Docs/Cmdlets` and committed (Decision 8).
-- Tests: Pester 5 tests in `Tests` (`Help.Tests.ps1`) against the Release
-  build.
+- Tests: Pester 5 tests in `Tests` against the Release build:
+  `Help.Tests.ps1` (help of every cmdlet), `Manifest.Tests.ps1` (manifest
+  and versions, Decision 10), and `Remove-Item2.Tests.ps1` (`-PassThur`
+  alias).
 
 ## Environment
 
@@ -61,16 +63,16 @@ source: repository evidence
 
 ## Constraints
 
-- `ModuleVersion` in the source manifest is `4.2.5`; the latest tag and
-  Gallery release is `4.2.6`.
+- `ModuleVersion` is `5.0.0` on `ai/manifest-version` (work package 4,
+  unreleased; `master` still says `4.2.5`); the latest tag and Gallery
+  release is `4.2.6`. The manifest requires PowerShell 5.1 and .NET
+  Framework 4.5.2, uses `RootModule`, and lists exactly 36 cmdlets;
+  `Test-ModuleManifest` passes in Windows PowerShell 5.1 and PowerShell 7.6.
 - Besides the shipped help file and its tests (#93), the module source at
   `master` differs from tag `4.2.6` only by the `Remove-Item2 -PassThur`
-  to `-PassThru` rename and `CompatiblePSEditions` in the manifest.
-- `CmdletsToExport` lists `Show-NTFSSimpleAccess`, which no longer exists
-  (WinForms code removed in `d3063de`), and repeats the inheritance cmdlets.
-- `Test-ModuleManifest` fails in Windows PowerShell 5.1:
-  `CompatiblePSEditions` requires `PowerShellVersion` 5.1 or higher, and the
-  manifest says `2.0` (work package 4).
+  to `-PassThru` rename and `CompatiblePSEditions` in the manifest; work
+  package 4 adds the manifest and version changes and the `-PassThur`
+  alias.
 - Releases have no script and no CI deployment. Evidence from 4.2.6: the
   Gallery DLLs are Debug builds (`DebuggableAttribute` 263), the nuspec
   comes from `Publish-Module`, the package holds the whole output folder