Complete identity-safe directory pruning acceptance

CHANGELOG.md

@@ -6,9 +6,11 @@ Following the `0.0.15-beta` prerelease, Windows client/server, IIS, Exchange, pr
 
 ### Changed
 
+- Complete issue #28's public-command directory-identity regressions for empty and populated replacements, retained-handle prevention, defensive identity refusal, deepest-first pruning, preservation boundaries, WhatIf and terminating errors. The fixture note distinguishes reachable production behavior from injected handle-loss tests; executable runtime behavior and lab gates are unchanged.
+
 - Complete the bounded issue #30 retention contract with deterministic acquisition-barrier fixtures for both temp commands. Cover recent/old replacements, renamed paths, directory/junction substitution, same-object relinking, current length and timestamp observations, writer failures and handle recovery. Document that attribute-only timestamp updates are not excluded by read-only sharing and retention validation is not atomic with deletion; runtime behavior and deferred acceptance gates remain unchanged.
 
-- Implement the issue #26 Zensical migration in PR #41: replace the active MkDocs/Material configuration and direct dependencies with pinned Zensical 0.0.62, preserve the classic navigation and generated command references, and retain the single-build manifest-to-`gh-pages` byte-verification controls. Review, merge, deployment, and lowercase-path acceptance remain open.
+- Complete the issue #26 Zensical migration in merged PR #41: replace the active MkDocs/Material configuration and direct dependencies with pinned Zensical 0.0.62, preserve the classic navigation and generated command references, and retain the single-build manifest-to-`gh-pages` byte-verification controls. Exact merged-source deployment and live canonical bytes are verified in the release ledger. The merged account-root companion supplies a JavaScript fallback for lowercase paths from its 404 page; it is not an HTTP redirect.
 
 ## 0.0.15-beta - 2026-09-17
 
@@ -32,7 +34,7 @@ Version `0.0.15-beta` was published from exact source `345f06c861b6d4074e5896e0b
 ### Changed
 
 - Prioritize non-lab documentation/delivery readiness and an optional approved prerelease; Windows, IIS, Exchange, and profile lab validation is deferred future work, not underway. Require succinct Completed / Remaining summaries in every successor prompt.
-- Use the working title-case `https://day3bits.com/TheCleaners/` URL consistently in configuration, manifest, source help, and documentation. Track support for both URL cases in Zensical issue #26.
+- Use the working title-case `https://day3bits.com/TheCleaners/` URL consistently in configuration, manifest, source help, and documentation. At this beta checkpoint, support for both URL cases was tracked in Zensical issue #26; the later completion is recorded in Unreleased above.
 - Configure the GitHub `powershell-gallery` environment with SamErde review, disabled administrator bypass and `v*` tag restrictions. Update the publishing workflow to use the dedicated `PSGALLERY_PUBLISH_API_KEY` environment secret, fail clearly when absent, and stop passing repository secrets to the build matrix. The protected `0.0.15-beta` run exercised the environment approval and credential through the exact-artifact publisher.
 - Add a closed local-rehearsal publisher mode that uses an existing local filesystem repository and an internal placeholder key. Preserve the exact-artifact guards shared with the fixed PSGallery production path and require an explicit valid source commit in both modes.
 - Bind publication to the maintainer-approved archive digest and verify the published version's installed payload, metadata, import, help, aliases and preview locks on fresh supported-runtime runners.
@@ -70,4 +72,4 @@ Protected publication run [35268852573](https://github.com/SamErde/TheCleaners/a
 
 ### Still pending
 
-Windows client/server, broader elevated/non-elevated, real-system-root, ReFS and adversarial/concurrency acceptance; IIS and Exchange product/build preview labs; and Windows profile-inventory acceptance are deferred future work, not underway. Final 1.0 release acceptance remains open. The bounded baseline uncovered-command review merged in PR #35; its remaining native/platform/product cases remain lab gates. The published beta does not close them. The Zensical framework migration is open in PR #41 under issue #26; review, merge, deployment, and the account-root lowercase redirect remain open.
+Windows client/server, broader elevated/non-elevated, real-system-root, ReFS and adversarial/concurrency acceptance; IIS and Exchange product/build preview labs; and Windows profile-inventory acceptance are deferred future work, not underway. Final 1.0 release acceptance remains open. The bounded baseline uncovered-command review merged in PR #35; its remaining native/platform/product cases remain lab gates. The published beta does not close them. The Zensical migration and account-root compatibility work were still pending at this beta checkpoint; their subsequent completion in PR #41 and the account-root companion is recorded in Unreleased above and the current release ledger.

docs/issue-28-directory-identity.md

@@ -0,0 +1,47 @@
+# Issue #28 directory-identity closure
+
+## Scope and result
+
+This packet closes the remaining deterministic fixture gap in [issue #28](https://github.com/SamErde/TheCleaners/issues/28). The runtime already retains native Windows directory handles through candidate mutation and compares volume/file identity before non-recursive pruning. No runtime defect was found, so this packet adds a dedicated public-command regression suite without changing production behavior.
+
+The initial implementation checkpoint used base commit `af330858b41335366476f0b845e3f73a3c1497d1` plus uncommitted test/documentation changes. It is retained below as historical evidence. The clean metadata-correction checkpoint records local committed fixture validation; final-head hosted CI across all supported runtimes and post-merge evidence remain separate checks.
+
+## Deterministic fixture design
+
+Every test redirects the current-user and Windows temp roots to a unique Pester fixture. `Clear-WindowsTemp` uses a controlled root resolver mock; the original environment is restored after each case. No cleaner targets actual user, Windows, IIS, Exchange, or other product data.
+
+The replacement regressions distinguish two safety layers:
+
+1. The production-reachable test deletes the old candidate, then attempts to move the touched directory aside and install a staged empty or populated replacement at the same path. The fixture requires the first move to throw native sharing violation 32; only a successful first move permits the staged replacement attempt. The retained DELETE-capable handle denies the move, so the replacement cannot occur while the plan remains active. The staged directory and any new file remain intact outside the cleanup root.
+2. The defensive identity test uses an explicitly labeled isolated fault injection at the same pre-prune boundary. It releases only the touched directory's retained handle, moves the now-empty original to a displaced path, and installs a real empty or populated directory at the original path. The displaced original stays alive to prevent file-ID reuse. Before reading the replacement identity, the fixture sets its creation time, last-write time, and attributes to the values captured for the planned original and asserts those mutable fields match. The command still observes that the native volume/file identity differs, skips the replacement and its ancestor, and reports no directory-removal failure.
+
+The second case demonstrates defense in depth when the primary handle barrier is unavailable. It is not a claim that production planning normally releases that handle or permits the physical replacement.
+
+## Acceptance mapping
+
+| Issue #28 criterion | Deterministic evidence |
+| --- | --- |
+| Preserve a touched directory removed and recreated at the same path before pruning | For both public commands, the intact production plan blocks the replacement attempt. The isolated fallback fixture then performs the replacement, verifies different native identities, and preserves the replacement and its ancestor. |
+| Verify both temp commands | Every case is parameterized across `Clear-CurrentUserTemp` and `Clear-WindowsTemp`. |
+| Cover recreated directories with and without new contents | The fallback fixture installs one empty replacement and one replacement containing `new.tmp` for each command; all four replacements remain. The primary handle test also stages and attempts both payloads. |
+| Preserve normal deepest-first pruning | Each command removes an old file, its child directory, and its parent in that order-sensitive plan, with two directory candidates and two removals. |
+| Preserve root, unrelated empty branches, recent files, and reparse points | The end-to-end boundary case retains the fixture root, an unrelated empty directory, a recent-file branch, a junction, and the junction target outside the cleanup root. |
+| Avoid path/timestamp-only identity proof | Tests use `FILE_ID_INFO` identities from the native interop. The fallback fixture explicitly matches creation time, last-write time, and attributes, then records unequal original and replacement identities while confirming the displaced original retains its planned identity. |
+| Keep `ShouldProcess` and error behavior | `-WhatIf` reports candidates and performs no mutation; mutation cases use explicit `-Confirm:$false`; a locked candidate with `-ErrorAction Stop` terminates with `TempFileRemovalFailed` and preserves directory ancestry. |
+| Validate the supported runtime matrix | Local coverage passed on PowerShell 7.6.6 and Windows PowerShell 5.1.26100.9444 with Pester 5.7.1. Full-matrix acceptance remains pending inspection of exact final-head hosted results, including PowerShell 7.4.20 and 7.5.11. |
+
+## Validation evidence
+
+Local fixture runs used Windows **10.0.26200.0**, PowerShell **7.6.6** and Windows PowerShell **5.1.26100.9444**, with pinned Pester **5.7.1**. Native interop was initialized before Pester under Windows PowerShell 5.1, matching the hosted workflow's runspace requirement. Each result below belongs only to its stated checkpoint; an older run does not validate a later correction.
+
+| Checkpoint | Result on each local runtime | Scope |
+| --- | --- | --- |
+| Initial base `af330858b41335366476f0b845e3f73a3c1497d1` plus uncommitted implementation | 14 passed, zero failed/skipped/not-run | Historical initial fixture suite. Reports: `%TEMP%\TheCleaners-issue28-evidence\pester-ps766.xml` and `pester-ps51.xml`. |
+| Clean integration `171b4cc558b875f72ffedd68aa051d6aeac6e43e` | 18/18 passed, zero failed/skipped/not-run | Original 14 fixtures plus four documentation contracts; predates the metadata-matching refinement. Strict Zensical 0.0.62 and PR-range whitespace checks also passed. |
+| Review base `581907e7d83c283de423c0f36d02b735c7153876` plus uncommitted refinement | 14 passed, zero failed/skipped/not-run | Historical first run with matching replacement metadata; reports `pester-review-followup-ps766.xml` and `pester-review-followup-ps51.xml` in the same temporary evidence directory. |
+| Clean correction `2372a218d04354df100c2d9188bc30c419764151` | 18/18 passed, zero failed/skipped/not-run | Includes the metadata-matching assertions and four documentation contracts. Retained reports: `issue28-final2372-ps7.json/.xml` and `issue28-final2372-ps51.json/.xml`. Test-file SHA-256: `d6f2c31c5625cec86cabee0fb5d9f856a40ed2f43ff3e479dbe326a2a8f8a6fa`. Strict Zensical 0.0.62 passed. |
+
+The clean correction's hosted build failed test-source analysis because two display-only `Article` parameters were unused; it did not pass the full build. Commit `da99d4ebdd0e8c76cba332eb506e06d2eda43691` removed those unused parameters and simplified the test descriptions without changing fixture logic. Its PowerShell parsers and PR-range whitespace check passed. Final-head hosted runtime reports, artifact inspection and post-merge results remain separate gates and are recorded in the PR and release ledger when verified.
+
+## Limitations
+This is deterministic local NTFS fixture evidence, not Windows client/server, ReFS, real-system-root, elevated/non-elevated, hostile-filter, or product lab acceptance. Issue #28 does not require ReFS validation, and the production help already states that the checks cannot provide an atomic defense when a filesystem or filter does not provide stable file IDs. Deferred lab gates and final 1.0 acceptance remain open.

docs/next-stage-prompts.md

@@ -1,23 +1,17 @@
-# Next-stage prompt
+**Completed:** Non-lab delivery and protected 0.0.15-beta publication are verified. Zensical PR #41 and retention PR #42 are merged; issues #26 and #30 are closed. PR #43's 14 directory-identity cases and PR #44's deletion-rights fixtures are implemented and locally validated. Canonical Zensical deployment from af330858b41335366476f0b845e3f73a3c1497d1 and PR #42's exact reviewed-head and merged-source runtime/artifact results have been verified separately; its merged documentation deployment and live bytes also passed.
 
-## Next: complete issue #26 review and deployment acceptance
+**Remaining:** Finish independent and hosted review, exact-head validation and merge for #28 PR #43 and #29 PR #44; verify #28/#29 merged-source results; then complete the final documentation sweep. TC-001 product acceptance, TC-003 through TC-007 lab acceptance and final TC-008/009 release acceptance remain open. Lab validation is deferred future work, not underway.
 
-**Completed:** Non-lab delivery and protected `0.0.15-beta` publication are verified. The Zensical 0.0.62 migration is implemented and locally validated with classic navigation, generated references, strict link checks, and the existing single-build exact-byte deployment controls.
+# Recovery: finish the authorized temp-issue sequence
 
-**Remaining:** Review and merge issue #26 [PR #41](https://github.com/SamErde/TheCleaners/pull/41), verify its exact deployed bytes, and resolve the hosting-level lowercase route. Narrow deterministic fixture/contract criteria in [#28](https://github.com/SamErde/TheCleaners/issues/28), [#29](https://github.com/SamErde/TheCleaners/issues/29), and [#30](https://github.com/SamErde/TheCleaners/issues/30) remain unexecuted; product labs stay paused.
+Continue SamErde/TheCleaners from the current release ledger. Read AGENTS.md, .github/copilot-instructions.md, docs/release-plan-1.0.md, the three issue evidence notes, and the issue/PR discussions. Refresh exact Git state, worktree ownership, open PRs, reviews, checks and paginated reviewThreads before acting; do not redo merged #41/#42 or select already implemented #28/#29 as new implementation work.
 
-Recommended model: GPT-5.6 Sol (`gpt-5.6-sol`), reasoning effort high. Use a different model for independent review when practical; escalate to Astra only for a concrete unresolved deployment or URL-routing risk.
+Use the existing isolated worktrees and preserve unrelated local changes. Sol high authored #28/#29; Terra high independently reviews #43, and Astra high reviews #44's ACL/native-identity scope. Sol high independently reviewed Astra high's #42 implementation. Keep one integrator for shared runtime, ledger and changelog writes. Use a different model for each independent review and reassess only if concrete risk warrants escalation.
 
-Continue TheCleaners from `docs/release-plan-1.0.md`. Read `AGENTS.md`, `.github/copilot-instructions.md`, the complete release plan, issue #26, and `docs/deployment-validation.md`. Verify repository identity, the exact candidate head, worktrees, uncommitted changes, and current pull-request state before writing.
+For each remaining PR, address every material finding and reply to its thread; record quota-skipped bot reviews as incomplete, not approvals. Require posted independent review, completed available hosted reviews, zero unresolved paginated review threads, passing exact-head checks and inspected source/runtime-bound reports, artifact digests and archives before a SHA-guarded merge. Rebase the later packet onto merged main and revalidate any resolution. Verify merge-triggered runs separately from PR-head evidence.
 
-Review the migration without changing runtime/package behavior or the published `0.0.15-beta` tag and source. Confirm that `zensical.toml` preserves the documented navigation and classic presentation, Zensical 0.0.62 is the only direct documentation dependency, strict validation passes, generated command references remain readable, and Read the Docs plus GitHub Pages use the supported build interface.
+Keep the documented observation contract: a deletion handle supplies identity, type, timestamp and logical length before disposition. Read-only sharing excludes ordinary data writers and renames but permits attribute-only timestamp updates; retention checking and deletion are not atomic. The #28 lost-handle test is explicit fault injection, not a reachable intact-plan race. For #29, distinguish documented 128-bit ReFS semantics and fail-closed behavior from unexecuted ReFS runtime acceptance.
 
-Preserve the delivery chain: one strict clean build into configured `site_dir`, add `.nojekyll`, create and retain the source/run-bound manifest, recheck the downloaded site, copy the exact checked bytes to `gh-pages`, and verify every public file plus representative navigation with bounded whole-attempt retries. Do not replace the existing hosting backend or weaken permissions, immutable action pins, manifest checks, or fail-closed behavior.
+The maintainer already authorized continuous execution through all three PR merges and the final documentation sweep. Continue without repeated merge approval. Update relevant help/docs, changelog and exact evidence in each packet, then sweep current status, command contracts, support boundaries and historical wording after all three close. Every future successor prompt must begin with succinct Completed / Remaining paragraphs refreshed from the release ledger and carry this requirement forward. Save updated recovery prompts while continuing the authorized work.
 
-Resolve all material review threads and require green exact-head checks. After merge, verify the exact merged-source build and retained artifacts before claiming deployment acceptance. Test `https://day3bits.com/TheCleaners/` and representative deep links. Lowercase `/thecleaners/` currently resolves at the account-site host before the project site and cannot be fixed by Zensical's docs-relative redirect maps. Do not emit case-only alias directory pairs on Windows. Evaluate the separately owned account-root redirect as a companion hosting change, preserving suffixes and the title-case canonical URL without loops.
-
-Treat the prior MkDocs deployment for source `345f06c861b6d4074e5896e0b27a19f869dfa7e3` as historical evidence only. A local build or PR-head run does not prove the migrated public site. Record exact source, workflow run and attempt, artifact-wrapper digests, file count/bytes/tree hash, `gh-pages` commit, navigation results, URL-case results, and browser observations for the merged deployment.
-
-Lab validation remains deferred future work and is not underway. Do not provision a host or begin TC-003 through TC-007 automatically. Keep IIS and Exchange structurally preview-only and preserve final TC-001/008/009 product and 1.0 acceptance as open gates.
-
-Save the next copy-ready prompt without executing it automatically. Begin it with concise **Completed / Remaining** paragraphs refreshed from the ledger. After issue #26 and its hosting follow-up are resolved, refresh the open-issue audit and select one bounded #28/#29/#30 deterministic regression/contract packet. Product labs still require new maintainer direction and approved disposable hosts.
+Use isolated fixtures only. Do not provision hosts/volumes, run actual-root cleanup or IIS/Exchange/profile labs, enable product deletion, create release tags, or publish to the Gallery. Final publication and credentials retain their separate approval boundaries. If no authorized non-lab work remains after the sweep, say so and leave labs deferred rather than starting them automatically.