chore(memory-bank): record group A and the shared test patterns

- activeContext.md: the results of ai/defects-a and the next step.
- progress.md: group A is fixed on ai/defects-a (not merged yet).
- systemPatterns.md: the sandbox test helpers and how platyPS takes a
  parameter position from the shipped help file; older bullets condensed
  to stay within the line budget.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -39,7 +39,14 @@ the PRs, and tags `5.0.0-rc2` after the merges.
   261 passed, 7 skipped; PowerShell 7 232 passed, 36 skipped (268 tests).
 - `ai/maintenance` adds `Tests\Repository.Tests.ps1` (8 tests): Windows
   PowerShell 269 passed, 7 skipped; PowerShell 7 240 passed, 36 skipped.
+  Review: Dependabot PRs ran unreviewed actions in a job with
+  `contents: write`; the wiki preview is now read-only (`publish-wiki`).
+- `ai/defects-a` fixes defects 1 to 13 and the same repeat bug in
+  `Get-NTFSAccess` (found with 4): Windows PowerShell 310 passed, 17
+  skipped; PowerShell 7 280 passed, 47 skipped (327 tests). 10 tests need
+  privileges and run only in CI.
 
 ## Next step
 
-Group A on `ai/defects-a`, starting with the shared test helpers.
+Group B (14 to 17) on `ai/defects-b`, then C, D, the E decisions, and the
+bugs from the issue triage (`ai/issue-fixes`).

.memory-bank/progress.md

@@ -93,7 +93,7 @@ authorization, restrict wiki editing to collaborators, and ask
 
 Numbered as agreed with the maintainer; each is documented on its page.
 
-#### A: Crashes and wrong results
+#### A: Crashes and wrong results (fixed on `ai/defects-a`, not merged)
 
 - (1) `Set-NTFSInheritance` reads an unset `Nullable<bool>` when
   `-AccessInheritanceEnabled` is omitted; omitted should mean unchanged.

.memory-bank/systemPatterns.md

@@ -66,32 +66,33 @@ Each Decision record is a file in `decisions/`; read only the relevant ones.
 - Run platyPS in Windows PowerShell 5.1 against a module build; a copy of
   `Docs/Cmdlets` must round-trip through `Update-MarkdownHelp` unchanged.
   platyPS rewrites non-ASCII punctuation, so keep cmdlet pages ASCII-only.
-- GitHub renders the docs (Decision 9); CI publishes them to the wiki
-  (Decision 11). MarkdownLinkCheck: relative `Docs` links, no anchors;
-  `Tests\Wiki.Tests.ps1`: every wiki link and anchor (GitHub slug rules).
-  Neither covers the links in `README.md` and `CHANGELOG.md`.
-- The wiki is generated from `Docs`; never edit the wiki. Pages are named
-  after their files, `Docs/README.md` becomes Home, and its cmdlet groups
-  form the sidebar; a cmdlet missing there fails `Wiki.Tests.ps1`.
-- In cmdlet pages, end a sentence with a link: platyPS renders a link as
-  `text (url)` in the help file and drops the space after it.
-- Verify examples in a `$env:TEMP` sandbox, never on real data; parse every
-  example and check its parameters against `Get-Command` metadata.
+  It takes a parameter's `Position` from `Get-Help`, that is from the shipped
+  help file: after a position change, edit the page YAML, run
+  `New-ExternalHelp`, rebuild, and check the round trip.
+- Links: MarkdownLinkCheck checks relative `Docs` links (no anchors),
+  `Tests\Wiki.Tests.ps1` the wiki links and anchors; neither covers
+  `README.md` and `CHANGELOG.md`. The wiki is generated from `Docs` (never
+  edit it); `Docs/README.md` becomes Home, its cmdlet groups the sidebar.
+- In cmdlet pages, end a sentence with a link (platyPS drops the space after
+  it). Verify examples in a `$env:TEMP` sandbox, never on real data.
 
 ### Testing the module
 
 - Pester 5 tests in `Tests/*.Tests.ps1` import
-  `NTFSSecurity\bin\Release\NTFSSecurity.psd1`; CI runs them in Windows
-  PowerShell 5.1 and in PowerShell 7 (Decision 11).
-- `Get-Help -Online` tests use the internal hook `BypassOnlineHelpRetrieval`
-  (URI instead of a browser); it skips the help file in PowerShell 7, so
-  those 36 tests run only in Windows PowerShell.
-- `.github/scripts/Invoke-Tests.ps1` runs Pester in CI: counts and failures
-  to the job summary, NUnit to `test-results`; failed test files fail too.
-- `Tests\Manifest.Tests.ps1`: `Test-ModuleManifest` without errors or
-  warnings, exactly 36 cmdlets, one version in manifest and assemblies
-  (Decision 10). A new cmdlet updates `CmdletsToExport` and that count.
-- `Tests\Release.Tests.ps1` checks that `CHANGELOG.md` has release notes
-  for the manifest version (dated section, or `[Unreleased]` for a
-  prerelease) and the packages: only `FileList` files, version with label,
-  command tags, and `NTFSSecurity.zip` with the module folder.
+  `NTFSSecurity\bin\Release\NTFSSecurity.psd1`; CI runs every file of
+  `Tests` in Windows PowerShell 5.1 and in PowerShell 7 (Decision 11) with
+  `.github/scripts/Invoke-Tests.ps1` (job summary, NUnit `test-results`).
+- A test that changes files, links, or security descriptors uses
+  `Tests\TestHelpers.psm1`: its own sandbox below
+  `$env:TEMP\NTFSSecurity.Tests`, `Assert-TestSandboxPath` before each
+  change, `Remove-TestSandbox` (links first, then ACL reset). Cases that need
+  a privilege skip with `Test-PrivilegeHeld` and run in CI (elevated);
+  `Block-TestReadPermission` (OWNER RIGHTS deny) makes a read fail without
+  elevation.
+- `Get-Help -Online` tests use the internal hook `BypassOnlineHelpRetrieval`,
+  which PowerShell 7 ignores for the help file: 36 tests run only in Windows
+  PowerShell.
+- `Manifest.Tests.ps1`: `Test-ModuleManifest` clean, exactly 36 cmdlets, one
+  version in manifest and assemblies (Decision 10). `Release.Tests.ps1`:
+  release notes for the manifest version, and the packages (`FileList`
+  files, version with label, command tags, zip layout).