Prepare ms-private 0.0.1 release candidate

docs/VALIDATION.md

@@ -2,28 +2,38 @@
 
 ## Completed checks
 
+Release-candidate update, 2026-09-22: 114 tests pass in each of Windows PowerShell 5.1 and PowerShell 7 (25 policy/transaction, 29 app/menu, 19 offline-bundle, 41 feature/package/security/service/account/preset/operation-runner). The policy tests include current-user registry scope and Enterprise-only selection. The app tests include aggressive all-removable-app and explicit Store selection, safe skipping of ambiguous desktop registrations, protection of security/dependency applications, completeness of FreshInstall/Medium/Strong/Maximum and the non-destructive EstablishedSafe preset, the reported JSON catalog failure and journal callback scope failure, browser-before-removal sequencing, installer errors, stale inventory, partial failure, bundle deduplication, group selection, keyboard navigation, filtering and terminal layout limits. Feature tests cover fresh/established/unknown install-age decisions, continued execution of independent groups after a failure, dependency skipping, preset schema refusal, shared Recall apply/skip/conflict decisions, atomic JSON replacement, malformed or duplicate policy/service/account/network catalogs, protected update-endpoint refusal, untrusted registry-hive refusal, network journal recovery, cleanup-root and protected-log refusal, recovery-journal exclusion, browser-cache scope, protected-service exclusion, service disable/restore, forged service-plan rejection, exact account-package reset, credential allowlisting, report redaction, VeraCrypt volume validation, versioned secret-free security audit behavior and AME manifest structure. Native arrow/Space/Enter/Esc browser selection was also exercised in a real Windows PowerShell console. Live host inventory, service planning and account planning were read-only. No real uninstall, account purge, policy or service write, reboot, firewall change, capture, device disable, Recall deletion or update installation was performed.
+
+The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. `Build-Executable.ps1` must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded `requireAdministrator` manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.
+
+These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The GitLab pipeline requires a Windows runner tagged `windows`; a remote pipeline result does not replace the live matrix.
+
 The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.
 
 The transaction test suite uses an in-memory registry adapter, never production policy writes. It covers edition gates, diagnostic choices, unsupported builds, update modes, microphone exceptions, original value types, read failures, exact restoration, reapply, journal failures, mid-apply failures, writes that fail after mutation, restore conflicts, interrupted operations, repeated restore, untrusted journal entries, installation mismatch and stale plans.
 
-Run `./tests/Run-Tests.ps1` with both PowerShell 7 and Windows PowerShell 5.1. Parse all `.ps1` / `.psm1` files with the PowerShell parser. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.
+Run `./tests/Run-All.ps1` with both PowerShell 7 and Windows PowerShell 5.1. This includes source parsing and all suites. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.
 
 ## VM matrix required before release
 
 | OS | Test |
 | --- | --- |
 | Windows 11 Home 24H2/25H2 | Audit reports unsupported machine policies; Apply makes no changes; manual guide matches current Settings |
-| Windows 11 Pro 24H2/25H2 | Standard/Strict apply, readback, reboot, behavioral checks and restore |
+| Windows 11 Pro 24H2/25H2 | Standard/Strict policy and service apply, readback, reboot, behavioral checks and restore |
 | Windows 11 Enterprise/Education 24H2/25H2 | Same, including actual diagnostic policy effect |
 | Unknown/future build | No automatic mutation until separately reviewed |
 | Domain/MDM managed device | Apply/Restore decline; no competing policies |
 | Non-admin / 32-bit process | Read-only operations work where possible; real mutation declines |
+| App operations: 19045 / 22631 / 26100 / 26200 | Verify exact selected uninstall scope, app-data behavior, browser installation and reboot. Use a supported servicing arrangement for Windows 10. |
+| Edge: supported / restricted removal | Verify successful uninstall where supported; otherwise report failure, preserve WebView2 and permit a revised keep-Edge plan. |
+| OneDrive: local / cloud-only / unsynced content | Confirm warnings, normal uninstall, unchanged sync folders and recovery using official installers. |
+| WinGet: missing / first-run / offline / cancelled installer | Abort safely; never misreport browser availability or proceed after a failed prerequisite. |
 
 Use snapshot-backed clean VMs, then repeat relevant tests on physical hardware. A VM does not validate real microphones, cameras, TPM behavior or physical network adapters. Never use production credentials in the test matrix.
 
 ## Behavior checks
 
-After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Confirm update scan/download/install and Defender updates still work in the normal profile.
+After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, activity upload, app capabilities, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Verify DiagTrack, CDPSvc, CDPUserSvc instances, cloud sync/backup and WER before and after reboot and restore. Confirm update scan/download/install, certificate refresh, Store revocation and Defender updates still work.
 
 Restore original registry types/values and absence; compare with the preflight snapshot. Keep externally changed settings intact and report conflicts. Test interruption before the first write, between writes, during journal replacement and during restore. Test a filled/read-only journal filesystem, registry permission denial and competing changes.
 
@@ -45,7 +55,7 @@ Verify exact WinGet package ID, publisher download domain, installer version/has
 
 Tor must remain on official update channels with stock fingerprinting protections. Zen and Helium need a current browser-security update check, visible sync/crash/permission decisions and tests that default-browser/profile import remain user-controlled.
 
-## Data deletion and lock checks for future modules
+## Data deletion and lock checks
 
 Require a separate preview for Recall snapshot removal, app data deletion and cleanup. Exclude Downloads/documents by default. Skip locked files, junctions and filesystem reparse points. Never recursively follow arbitrary paths in a cleanup tool.