fix(hygiene): flag tracked .bak files, remove the remaining three, ignore *.bak

[drmoisan]

Suggested title

fix(hygiene): flag tracked .bak files, remove the remaining three, ignore *.bak

Summary

• Adds rule C to the repository hygiene guard: a tracked path whose final extension is .bak (case-insensitive) is reported as HYGIENE backup-file <path> and fails the guard. The pure predicate is the new function Test-BackupFilePath in scripts/hygiene/Test-RepositoryHygiene.Rules.ps1; the wiring is one if in Invoke-RepositoryHygieneMain.
• Deletes the three remaining tracked backups: TaskMaster.sln.bak, TaskTree/TaskTree.vbproj.bak and TaskVisualization/TaskVisualization.vbproj.bak.
• Adds a general *.bak line to .gitignore directly after *.csproj.bak.
• Updates the _hygiene.yml row of .github/workflows/README.md to name the new rule.
• Adds 14 Pester tests (10 for the predicate, 4 orchestration cases). The suite grows from 31 to 45 tests.

Why

The earlier backup cleanup scoped its ignore rule to *.csproj.bak, which left three other tracked backups that carry stale project and solution text. Nothing enforced the absence of tracked backups, so they could reappear. A hygiene guard rule makes the absence a CI-checked property.

Search of the tracked tree (outside docs/ and .claude/) found no project, solution, script or workflow file that reads the three backups; the only references to .bak are the .gitignore and one unrelated C# test file.

What Changed

• Guard (production): Test-BackupFilePath returns the result of [System.IO.Path]::GetExtension($RelativePath) -ieq '.bak'. The new if sits after the .claude/ governance skip and before the content scan, with no continue, so a backup file is still scanned for profile paths. The header comment, .SYNOPSIS and .DESCRIPTION of the guard script now describe rule C.
• Tests: Test-RepositoryHygiene.Rules.Tests.ps1 gains a Describe 'Test-BackupFilePath' block of 10 cases (positive: root and nested backups, upper-case extension, bare .bak; negative: directory named bak, .bakery, notes.bak.md, backup, no extension, bare bak). Test-RepositoryHygiene.Tests.ps1 gains four Invoke-RepositoryHygieneMain cases: a negative control, backup-lookalike names, a governance-directory record, and a backup file that also carries a profile path.
• Repository content: three git rm deletions, one .gitignore line, one README table row.
• Docs: feature folder docs/features/active/2026-10-01-remaining-tracked-backup-files-and-hygiene-guard-rule-961/ with the plan, evidence and the reduced audit artifacts; the promoted potential record.

Architecture / How It Fits Together

Test-RepositoryHygiene.ps1 enumerates tracked paths through the Git adapter, skips .claude/ records, then applies rule C (path-only, via the pure predicate) and the existing content rules A and B. Rule C emits HYGIENE backup-file <path>. The Git adapter Test-RepositoryHygiene.Git.ps1 is unchanged. The _hygiene.yml workflow runs this guard unchanged.

Verification

Completed (from the evidence in the feature folder):

• Expect-fail run before the production change: 45 tests, 12 failures (10 predicate tests, the negative control and the combined profile-path case).
• Run after the fix: 45 tests, 0 errors, 0 failures. Baseline was 31 tests.
• Guard over the real tree with the backups still tracked: exit 1 with three HYGIENE backup-file lines and HYGIENE Findings=3. After the change: HYGIENE Findings=0.
• git ls-files -- "*.bak" is empty; git check-ignore -v reports .gitignore:259:*.bak for the three former paths; a negative control (README.md) exits 1.
• PoshQC format (six files unchanged by hash comparison) and PoshQC analyze (pass, 0 findings; the tool reports no count) were run through the PoshQC MCP tools.
• Footprint against the base commit is exactly nine non-docs paths (three deletions, six modifications).
• Reduced small-audit: PASS with no blocking findings; AC 7 of 7 verified.

Recommended:

• Read the CI Pester job for this head: scripts/hygiene line coverage must meet the 80 percent LINE threshold in _pester.yml. Local PoshQC coverage does not carry scripts/hygiene, so the figure is CI-sourced.

Backward Compatibility / Migration Notes

A newly tracked file with a .bak extension anywhere outside .claude/ now fails the hygiene guard. The three removed backups were unreferenced. Git history is not rewritten.

Risks and Mitigations

• A legitimate tracked file named *.bak would fail the guard. No such file is tracked today; the .claude/ governance directory remains exempt. Mitigation: rename the file or discuss an exemption in a follow-up.
• The broader *.bak ignore line makes the older *.csproj.bak and *.rptproj.bak lines redundant. They are left in place; removal is cosmetic.
• Rollback: revert this change; the deleted backups remain in git history.

Review Guide

1. scripts/hygiene/Test-RepositoryHygiene.Rules.ps1 and scripts/hygiene/Test-RepositoryHygiene.ps1 (about 30 added lines).
2. The two test files under tests/scripts/hygiene/.
3. .gitignore and .github/workflows/README.md (one line each).
4. The three deletions (mechanical).
5. The feature folder is evidence and audit documents; read feature-audit.*.md first.

Follow-ups

• Optional: add -Because text to the array-equality assertions in the four new orchestration tests and split the lookalike test into per-name cases (code review items CR-1 and CR-2, low severity).
• Optional: remove the now-redundant *.csproj.bak and *.rptproj.bak lines from .gitignore (CR-3).
• Read the CI-measured scripts/hygiene line coverage for this head once the Pester job reports.

GitHub Auto-close

• Closes Bug: remaining-tracked-backup-files-and-hygiene-guard-rule #961

🤖 Generated with Claude Code