chore(memory-bank): record CI elevation and the E decision details

- GitHub-hosted Windows runners run as administrators with UAC disabled,
  so tests that need elevation run in CI; the workstation isn't elevated.
- E1 and E2 now state exactly what the cmdlets do; E4 notes that
  MACTripleDES may use a random key (to verify).
- Contents of the remote branches fix/#34 and test/transfer.
- Finished work packages condensed to stay under the line budget.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/progress.md

@@ -52,27 +52,20 @@ Work packages in the order agreed with the maintainer. Each gets one
 opens the PR (the agent can't; see `techContext.md`, Constraints), and the
 next package starts only after the maintainer's go-ahead.
 
-1. Housekeeping: done (#92).
+Items 1 to 4c are done: housekeeping (#92), shipped help (#93), docs on
-2. Ship help: done (#93).
+GitHub (#94), manifest and version 5.0.0 (#95), CI and the wiki on GitHub
-3. Docs on GitHub: done (#94).
+Actions (#96), version history from the Gallery (#97). Optional for the
-4. Manifest and version 5.0.0: done (#95).
+maintainer: delete the AppVeyor project and revoke its GitHub
-4b. CI and the wiki on GitHub Actions: done (#96). No AppVeyor webhook or
+authorization, restrict wiki editing to collaborators, and ask
-   commit status remains. Optional for the maintainer: delete the AppVeyor
+`Sup3rlativ3` to delete the Read the Docs project.
-   project and revoke its GitHub authorization, check **Restrict editing to
+
-   collaborators only** for the wiki, and ask `Sup3rlativ3` to delete the
-   Read the Docs project.
-4c. Version history from the PowerShell Gallery: done (#97).
 4d. Release 5.0.0 through CI (Decision 12): 5.0.0-rc1 published and
-   verified (#98); the command search lists it since 20:22 UTC. Next: the
+   verified (#98); the maintainer tests it. The final release PR comes on
-   maintainer tests the prerelease. The final release PR comes on release
+   release day (CI warns when the changelog date isn't that day): remove
-   day, because the changelog date should be that day (CI warns
+   the label, date `[Unreleased]` as `[5.0.0]`, tag `5.0.0` (steps in
-   otherwise): remove the label, rename `[Unreleased]` to `[5.0.0]` with
+   `Docs/Contributing/05-Releasing.md`). Also consider the manifest
-   the date, and tag `5.0.0` (steps in `Docs/Contributing/05-Releasing.md`).
+   `Description` ("Windows PowerShell Module") and the `5.0.0-rc1` example
-   Also consider the manifest `Description`, which says "Windows
+   in `Docs/README.md`. Releases no longer come from a local Debug build.
-   PowerShell Module", and the `5.0.0-rc1` example in `Docs/README.md`.
-   Releases no longer come from a local build, so the old manual steps
-   (cleaning `C:\Program Files\WindowsPowerShell\Modules\NTFSSecurity`,
-   Debug builds) no longer apply.
 4e. Repository settings, proposed to the maintainer on 2026-10-04 (not yet
    agreed): the `powershell-gallery` environment has no protection rules
    and no deployment policy, so a workflow on any branch can use
@@ -84,13 +77,17 @@ next package starts only after the maintainer's go-ahead.
 5. Code defects, listed below: `review: on`, one PR per group, regression
    test first. Pester 5 tests import `NTFSSecurity\bin\Release`, run in a
    `$env:TEMP` sandbox and in the CI workflow (pattern:
-   `Tests\Help.Tests.ps1`), and skip elevated cases when not elevated;
+   `Tests\Help.Tests.ps1`), and skip elevated cases when not elevated.
-   check whether the GitHub Actions Windows runner runs elevated. Each fix
+   GitHub-hosted Windows runners run as administrators with UAC disabled
-   updates its cmdlet page and `CHANGELOG.md`. Start by triaging the 37
+   (GitHub docs, checked 2026-10-04), so elevated cases run in CI; the
-   open issues (none newer than May 2025): #15, #47, and #66
+   workstation session isn't elevated. Each fix updates its cmdlet page
-   (documentation) and #19 (fixed in 4.2.4) can be closed; #4 is defect
+   and `CHANGELOG.md`. Start by triaging the 37 open issues (none newer
-   (5); #34 has the WIP branch `fix/#34`. The E decisions set the next
+   than May 2025): #15, #47, and #66 (documentation) and #19 (fixed in
-   version: fixes only 5.0.1, additions 5.1.0, changed defaults 6.0.0.
+   4.2.4) can be closed; #4 is defect (5); #34 has the WIP branch
+   `fix/#34` (`Extensions.cs`, `FileSystemSecurity2.cs`, `TestClient`);
+   `test/transfer` only adds a 3 MB `New.zip`. The E decisions set the
+   next version: fixes only 5.0.1, additions 5.1.0, changed defaults
+   6.0.0, unless they ship in 5.0.0 (rc2).
 
 ### Code defects (work package 5)
 
@@ -162,11 +159,17 @@ Numbered as agreed with the maintainer; each is documented on its page.
 
 #### E: Maintainer decisions before changing behavior
 
-- `Clear-NTFSAccess -DisableInheritance` discards inherited entries: keep
+- `Clear-NTFSAccess -DisableInheritance` removes the explicit entries and
-  that, or copy them?
+  then disables inheritance without copying the inherited ones, which
-- `Set-NTFSInheritance` defaults are the opposite of the dedicated
+  leaves an empty DACL: keep that, or copy them?
-  inheritance cmdlets: align?
+- `Set-NTFSInheritance` differs from the dedicated cmdlets in two of four
+  directions: `-AccessInheritanceEnabled $false` removes the inherited
+  access entries, and `-AuditInheritanceEnabled $true` removes the
+  explicit audit entries; the dedicated cmdlets keep them unless a switch
+  is given. Align?
 - The audit inheritance switches are named `*AccessRules`: add
   `*AuditRules` aliases?
 - `Get-FileHash2` fails in PowerShell 7 (`RIPEMD160`): drop the algorithm
-  there, load it lazily, or deprecate the cmdlet?
+  there, load it lazily, or deprecate the cmdlet? To verify:
+  `MACTripleDES.Create()` may use a random key, so its result would differ
+  on every call.