File Recovery Flow v0.1.5-test

File Recovery Flow v0.1.5-test

Testing prerelease for a technician machine with a disposable case. It is not a
production release: live File Scavenger and R-Studio behavior and the UAC path
remain owner validation gates.

Built from the exact commit printed at the bottom of these notes. Hosted GitHub
Actions on that commit is green in all four jobs: static-linux, compat-analyze
(PSScriptAnalyzer 5.1 syntax and command rules), and test-windows on
windows-2022 and windows-2025 under Windows PowerShell 5.1.

What changed since v0.1.2-test

The previous testing package could not run a normal case and failed the hosted
Windows lane. Both are fixed.

Front door

• The real -File entry point forwarded only -ConfigPath, -NoPause, and
  -DryRun, so -SourcePath, -DestinationPath, and -ClientName were
  silently dropped and the elevated relaunch lost them as well. Every documented
  input now reaches the workflow through both the in-process call and the UAC
  relaunch, and -DryRun reports the inputs it received.
• The elevated relaunch uses the PowerShell host that is actually running
  instead of a fixed $PSHOME\powershell.exe path.
• Positional binding is disabled: a stray token can no longer be read as the
  configuration path.
• The documented interactive flow is now wired: source selection (folder browser
  with a typed fallback), write-protection attestation, destination selection,
  and the client-name prompt. Every default stays fail-closed when the technician
  does not answer, and a dry run never prompts.

Storage safety

• Dynamic-disk evidence no longer depends on an IsDynamic field that the
  documented MSFT_Disk schema does not define; a real Windows disk view could
  never satisfy the old check. A stated dynamic flag still decides on its own,
  otherwise documented partition evidence decides (LDM metadata and LDM data GPT
  types, and MBR type 0x42). An empty, blank, mismatched, or failed partition view
  proves nothing, and a disk is only complete when the disk view and the partition
  view agree.
• A member list that cannot be parsed in full no longer authorizes the subset
  that happened to parse, and an absent membership statement is no longer read as
  membership complete: absence fails closed like every other unproven statement.
• A reparse point is no longer reported as resolved without a resolved target
  chain.

Case evidence

• The event log is no longer held open for the life of the case. On Windows the
  held handle made the live case record unreadable to every other reader (a
  sharing violation) and unremovable. Each event is appended and flushed on its
  own, integrity is enforced by a recorded offset, and an out-of-band change is
  refused and blocks further writes.
• The R-Studio -log switch no longer points at the JSONL case event log. It
  targets a dedicated rstudio-host.log in the case folder, so vendor text
  cannot corrupt the case record.

Path validation

• R-Studio, technician UI, and application-discovery path validation now reject
  illegal characters before any System.IO.Path call. On Windows that call threw
  ArgumentException instead of refusing.

Windows lane

• The compatibility analyzer runs production files under the 5.1 syntax and
  command rules, and test files under the syntax rule only: Pester's own DSL is
  not part of any Windows PowerShell profile and produced 1443 findings that
  described the test framework, not this project.
• The launcher harness compares the raw argument vector without the host process
  name, invokes cmd.exe with /d /s /c so a quoted launcher path survives quote
  stripping, and reads the child exit code reliably under Windows PowerShell 5.1.
• The dry-run launcher step asserts exit code 0 instead of recording an arbitrary
  code and reporting success.

Independent review round

An independent reviewer audited the integrated diff and found one fail-open
default plus smaller defects; all are fixed in this build:

• An absent membership statement used to be read as "complete".
• A blank partition type string was counted as a stated type.
• The fresh-safety protection record dropped the field that marks evidence as an
  operator attestation rather than a measurement.
• Application did not refuse '|', '<' and '>' while the other guarded modules did.
• The elevated relaunch did not refuse a value containing a double quote, and a
  dry run still raised a UAC prompt even though it starts nothing.
• A rewrite of the case record that kept the byte length was accepted. The log now
  records a hash of its trailing window after every append, so a same-length
  rewrite is refused and blocks further writes. A rewrite confined to bytes outside
  that window with an unchanged length remains undetected; that limitation is
  recorded in the handoff rather than hidden.
• The uploaded Pester reports were silently dropped because the hidden
  .test-results directory is excluded by default, and the non-live lanes
  discovered tests/Live before filtering it by tag under the pinned Pester 5.x.

Third round: unparsable evidence now refuses instead of crashing

The read-only audit found values the code could not cast escaping as an unhandled
workflow error (exit 9) instead of the documented refusal, which also tells the
technician the wrong thing about what happened:

• A capacity reading such as n/a is now parsed defensively and reported as
  unknown capacity, instead of throwing Cannot convert value "n/a" to type System.Int64 out of the run.
• A case-log record whose sequence cannot be read as a number is reported as an
  invalid sequence with the offending line, instead of throwing out of the
  validator.
• A state whose schema version or durable sequence cannot be read as a number is
  refused as an invalid state rather than throwing inside the binding check.

Verification in this build

• Local non-live lanes: 405 passed, 0 failed, 12 Windows-only skipped.
• Hosted: static-linux, compat-analyze, test-windows (windows-2022), and
  test-windows (windows-2025) all green on this commit.
• ZIP contents verified against the exact commit, every member byte-compared,
  Start-Recovery.bat CRLF, ASCII and no BOM.

Still an owner gate

Run docs/LIVE-VALIDATION.md on a disposable Windows machine with licensed
builds. Nothing in this package was exercised against real File Scavenger or
R-Studio, no real recovery media was touched, and the UAC prompt path is a live
check. Known open items are listed in the agent handoff notes.

File Recovery Flow v0.1.4-test

File Recovery Flow v0.1.4-test

Testing prerelease for a technician machine with a disposable case. It is not a
production release: live File Scavenger and R-Studio behavior and the UAC path
remain owner validation gates.

Built from the exact commit printed at the bottom of these notes. Hosted GitHub
Actions on that commit is green in all four jobs: static-linux, compat-analyze
(PSScriptAnalyzer 5.1 syntax and command rules), and test-windows on
windows-2022 and windows-2025 under Windows PowerShell 5.1.

What changed since v0.1.2-test

The previous testing package could not run a normal case and failed the hosted
Windows lane. Both are fixed.

Front door

• The real -File entry point forwarded only -ConfigPath, -NoPause, and
  -DryRun, so -SourcePath, -DestinationPath, and -ClientName were
  silently dropped and the elevated relaunch lost them as well. Every documented
  input now reaches the workflow through both the in-process call and the UAC
  relaunch, and -DryRun reports the inputs it received.
• The elevated relaunch uses the PowerShell host that is actually running
  instead of a fixed $PSHOME\powershell.exe path.
• Positional binding is disabled: a stray token can no longer be read as the
  configuration path.
• The documented interactive flow is now wired: source selection (folder browser
  with a typed fallback), write-protection attestation, destination selection,
  and the client-name prompt. Every default stays fail-closed when the technician
  does not answer, and a dry run never prompts.

Storage safety

• Dynamic-disk evidence no longer depends on an IsDynamic field that the
  documented MSFT_Disk schema does not define; a real Windows disk view could
  never satisfy the old check. A stated dynamic flag still decides on its own,
  otherwise documented partition evidence decides (LDM metadata and LDM data GPT
  types, and MBR type 0x42). An empty, blank, mismatched, or failed partition view
  proves nothing, and a disk is only complete when the disk view and the partition
  view agree.
• A member list that cannot be parsed in full no longer authorizes the subset
  that happened to parse, and an absent membership statement is no longer read as
  membership complete: absence fails closed like every other unproven statement.
• A reparse point is no longer reported as resolved without a resolved target
  chain.

Case evidence

• The event log is no longer held open for the life of the case. On Windows the
  held handle made the live case record unreadable to every other reader (a
  sharing violation) and unremovable. Each event is appended and flushed on its
  own, integrity is enforced by a recorded offset, and an out-of-band change is
  refused and blocks further writes.
• The R-Studio -log switch no longer points at the JSONL case event log. It
  targets a dedicated rstudio-host.log in the case folder, so vendor text
  cannot corrupt the case record.

Path validation

• R-Studio, technician UI, and application-discovery path validation now reject
  illegal characters before any System.IO.Path call. On Windows that call threw
  ArgumentException instead of refusing.

Windows lane

• The compatibility analyzer runs production files under the 5.1 syntax and
  command rules, and test files under the syntax rule only: Pester's own DSL is
  not part of any Windows PowerShell profile and produced 1443 findings that
  described the test framework, not this project.
• The launcher harness compares the raw argument vector without the host process
  name, invokes cmd.exe with /d /s /c so a quoted launcher path survives quote
  stripping, and reads the child exit code reliably under Windows PowerShell 5.1.
• The dry-run launcher step asserts exit code 0 instead of recording an arbitrary
  code and reporting success.

Independent review round

An independent reviewer audited the integrated diff and found one fail-open
default plus smaller defects; all are fixed in this build:

• An absent membership statement used to be read as "complete".
• A blank partition type string was counted as a stated type.
• The fresh-safety protection record dropped the field that marks evidence as an
  operator attestation rather than a measurement.
• Application did not refuse '|', '<' and '>' while the other guarded modules did.
• The elevated relaunch did not refuse a value containing a double quote, and a
  dry run still raised a UAC prompt even though it starts nothing.
• A rewrite of the case record that kept the byte length was accepted. The log now
  records a hash of its trailing window after every append, so a same-length
  rewrite is refused and blocks further writes. A rewrite confined to bytes outside
  that window with an unchanged length remains undetected; that limitation is
  recorded in the handoff rather than hidden.
• The uploaded Pester reports were silently dropped because the hidden
  .test-results directory is excluded by default, and the non-live lanes
  discovered tests/Live before filtering it by tag under the pinned Pester 5.x.

Verification in this build

• Local non-live lanes: 404 passed, 0 failed, 12 Windows-only skipped.
• Hosted: static-linux, compat-analyze, test-windows (windows-2022), and
  test-windows (windows-2025) all green on this commit.
• ZIP contents verified against the exact commit, every member byte-compared,
  Start-Recovery.bat CRLF, ASCII and no BOM.

Still an owner gate

Run docs/LIVE-VALIDATION.md on a disposable Windows machine with licensed
builds. Nothing in this package was exercised against real File Scavenger or
R-Studio, no real recovery media was touched, and the UAC prompt path is a live
check. Known open items are listed in the agent handoff notes.

File Recovery Flow v0.1.3-test

File Recovery Flow v0.1.3-test

Testing prerelease for a technician machine with a disposable case. It is not a
production release: live File Scavenger and R-Studio behavior and the UAC path
remain owner validation gates.

Built from the exact commit printed at the bottom of these notes. Hosted GitHub
Actions on that commit is green in all four jobs: static-linux, compat-analyze
(PSScriptAnalyzer 5.1 syntax and command rules), and test-windows on
windows-2022 and windows-2025 under Windows PowerShell 5.1.

What changed since v0.1.2-test

The previous testing package could not run a normal case and failed the hosted
Windows lane. Both are fixed.

Front door

• The real -File entry point forwarded only -ConfigPath, -NoPause, and
  -DryRun, so -SourcePath, -DestinationPath, and -ClientName were
  silently dropped and the elevated relaunch lost them as well. Every documented
  input now reaches the workflow through both the in-process call and the UAC
  relaunch, and -DryRun reports the inputs it received.
• The elevated relaunch uses the PowerShell host that is actually running
  instead of a fixed $PSHOME\powershell.exe path.
• Positional binding is disabled: a stray token can no longer be read as the
  configuration path.
• The documented interactive flow is now wired: source selection (folder browser
  with a typed fallback), write-protection attestation, destination selection,
  and the client-name prompt. Every default stays fail-closed when the technician
  does not answer, and a dry run never prompts.

Storage safety

• Dynamic-disk evidence no longer depends on an IsDynamic field that the
  documented MSFT_Disk schema does not define; a real Windows disk view could
  never satisfy the old check. A stated dynamic flag still decides on its own,
  otherwise documented partition evidence decides (LDM metadata and LDM data GPT
  types, and MBR type 0x42). An empty, mismatched, or failed partition view
  proves nothing, and a disk is only complete when the disk view and the
  partition view agree.
• A member list that cannot be parsed in full no longer authorizes the subset
  that happened to parse.
• A reparse point is no longer reported as resolved without a resolved target
  chain.

Case evidence

• The event log is no longer held open for the life of the case. On Windows the
  held handle made the live case record unreadable to every other reader (a
  sharing violation) and unremovable. Each event is appended and flushed on its
  own, integrity is enforced by a recorded offset, and an out-of-band change is
  refused and blocks further writes.
• The R-Studio -log switch no longer points at the JSONL case event log. It
  targets a dedicated rstudio-host.log in the case folder, so vendor text
  cannot corrupt the case record.

Path validation

• R-Studio, technician UI, and application-discovery path validation now reject
  illegal characters before any System.IO.Path call. On Windows that call threw
  ArgumentException instead of refusing.

Windows lane

• The compatibility analyzer runs production files under the 5.1 syntax and
  command rules, and test files under the syntax rule only: Pester's own DSL is
  not part of any Windows PowerShell profile and produced 1443 findings that
  described the test framework, not this project.
• The launcher harness compares the raw argument vector without the host process
  name, invokes cmd.exe with /d /s /c so a quoted launcher path survives quote
  stripping, and reads the child exit code reliably under Windows PowerShell 5.1.
• The dry-run launcher step asserts exit code 0 instead of recording an arbitrary
  code and reporting success.

Verification in this build

• Local non-live lanes: 401 passed, 0 failed, 12 Windows-only skipped.
• Hosted: static-linux, compat-analyze, test-windows (windows-2022), and
  test-windows (windows-2025) all green on this commit.
• ZIP contents verified against the exact commit, every member byte-compared,
  Start-Recovery.bat CRLF, ASCII and no BOM.

Still an owner gate

Run docs/LIVE-VALIDATION.md on a disposable Windows machine with licensed
builds. Nothing in this package was exercised against real File Scavenger or
R-Studio, no real recovery media was touched, and the UAC prompt path is a live
check. Known open items are listed in the agent handoff notes.

File Recovery Flow v0.1.2-test

Testing bundle preserving the legacy public module command names as exported aliases without reintroducing unapproved-verb import warnings. Includes the v0.1.1-test UAC self-elevation and approved canonical verbs. Local verification: static 52 passed, unit 302 passed, integration 16 passed with 12 Windows-only launcher tests skipped on Linux. Hosted Windows CI and live File Scavenger/R-Studio validation remain open gates.

File Recovery Flow v0.1.1-test

Testing bundle fixing two owner-reported issues: the entry point now self-elevates through UAC when needed, waits for the elevated Windows PowerShell 5.1 child, and propagates its exit code; DiskDetection, RecoveryLogging, and JobState exported commands now use approved PowerShell verbs. Local verification: static 52 passed, unit 302 passed, integration 16 passed with 12 Windows-only launcher tests skipped on Linux. GitHub-hosted Windows Actions and live File Scavenger/R-Studio validation remain owner gates.

File Recovery Flow v0.1.0-test

Testing source bundle for technician Windows validation. Local verification: static 50 passed, unit 301 passed, integration 16 passed with 12 Windows-only launcher tests skipped on Linux. GitHub-hosted Windows Actions were blocked by the account billing hold; live File Scavenger/R-Studio validation remains owner-only.