windowsweep 1.3.2 → 1.4.1

package/modules/browser_ai.ps1

@@ -0,0 +1,68 @@
+# browser_ai.ps1 - section 29: the Chrome on-device AI model (OptGuideOnDeviceModel, ~4 GB on the P52, 2026-11-02).
+# Deleting the folder alone is pointless - Chrome downloads it again. The GenAILocalFoundationalModelSettings
+# policy (1 = do not download) stops that, and Chrome then removes the model itself on its next start (seen on the
+# P52 the same day). Any Chrome policy makes Chrome show "Managed by your organization". ASCII only.
+
+$Script:WS_BROWSERAI_POLICY_KEY = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
+$Script:WS_BROWSERAI_POLICY_VALUE = 'GenAILocalFoundationalModelSettings'
+$Script:WS_BROWSERAI_UNDO = 'reg delete HKLM\SOFTWARE\Policies\Google\Chrome /v GenAILocalFoundationalModelSettings /f'
+
+function Get-ChromeUserDataRoots {
+  <# .SYNOPSIS The User Data roots of every installed Chrome channel; all of them read the Google\Chrome policy. #>
+  $L = $Script:P.L
+  return @(@('Google\Chrome', 'Google\Chrome Beta', 'Google\Chrome Dev', 'Google\Chrome SxS') | ForEach-Object { Join-Path $L "$_\User Data" } | Where-Object { Test-DirPresent $_ })
+}
+
+function Get-BrowserAiPolicyState {
+  <# .SYNOPSIS The policy's current value (1 = the model is not downloaded), or $null when it is not set. #>
+  param([string] $KeyPath = $Script:WS_BROWSERAI_POLICY_KEY)
+  try { $v = (Get-ItemProperty -LiteralPath $KeyPath -Name $Script:WS_BROWSERAI_POLICY_VALUE -ErrorAction Stop).($Script:WS_BROWSERAI_POLICY_VALUE); return [int]$v } catch { return $null }
+}
+
+function Set-BrowserAiPolicy {
+  <# .SYNOPSIS Set the policy to 1. --dry-run prints and writes nothing. -KeyPath lets the self-test use a
+     throwaway HKCU key instead of the machine policy. Returns 'set', 'would-set' or 'failed'. #>
+  param([string] $KeyPath = $Script:WS_BROWSERAI_POLICY_KEY)
+  if ($Script:WS.DryRun) { Write-DryRun "would set $KeyPath\$($Script:WS_BROWSERAI_POLICY_VALUE) = 1 (DWORD)"; return 'would-set' }
+  try {
+    if (-not (Test-Path -LiteralPath $KeyPath)) { New-Item -Path $KeyPath -Force -ErrorAction Stop | Out-Null }
+    New-ItemProperty -LiteralPath $KeyPath -Name $Script:WS_BROWSERAI_POLICY_VALUE -Value 1 -PropertyType DWord -Force -ErrorAction Stop | Out-Null
+    Write-LogLine "policy set: $KeyPath\$($Script:WS_BROWSERAI_POLICY_VALUE) = 1"
+    return 'set'
+  } catch {
+    Write-Err "could not set the Chrome policy: $($_.Exception.Message)"
+    return 'failed'
+  }
+}
+
+function Get-Targets29 {
+  $t = @((New-Target 29 'Chrome policy GenAILocalFoundationalModelSettings = 1' $Script:WS_BROWSERAI_POLICY_KEY -Kind cmd -Note 'stops the download; Chrome then removes the model itself'))
+  foreach ($root in (Get-ChromeUserDataRoots)) {
+    $t += (New-Target 29 'Chrome on-device AI model' (Join-Path $root 'OptGuideOnDeviceModel') -Mode clear -Guard @('chrome') -Note 'removed now only while Chrome is closed')
+  }
+  return $t
+}
+
+function Invoke-Section29 {
+  $ws = $Script:WS
+  Write-SectionIntro @(
+    'Chrome downloads an on-device AI model of several GB. Deleting it alone is pointless - Chrome fetches it again.',
+    'This sets the Chrome policy that stops the download; Chrome then removes the model on its next start.',
+    'Chrome will show "Managed by your organization" while the policy is set.'
+  )
+  $models = @(Get-ChromeUserDataRoots | ForEach-Object { Join-Path $_ 'OptGuideOnDeviceModel' } | Where-Object { Test-DirPresent $_ })
+  foreach ($m in $models) { Write-UiLine ("  {0,10}  {1}" -f (Format-Bytes (Get-DirectoryBytes $m)), $m) 'Gray' }
+  if ($models.Count -eq 0) { Write-Info 'no on-device AI model folder found' }
+  if ((Get-BrowserAiPolicyState) -eq 1) {
+    Write-Info 'the policy is already set - Chrome will not download the model again'
+  } else {
+    if (-not (Confirm-Section 'Set the Chrome policy that removes the on-device AI model?' 'n')) { Write-Info 'skipped'; return }
+    if ((Set-BrowserAiPolicy) -eq 'set') { Write-Ok 'Chrome policy set: the on-device AI model will not be downloaded again' }
+  }
+  foreach ($m in $models) {
+    if (Test-ProcessRunning @('chrome')) { Write-Note "Chrome is running - it removes $m itself on its next start"; continue }
+    $r = Remove-PathSafe -Path $m -Within (Split-Path -Parent $m) -Label 'Chrome on-device AI model'
+    if ($r.Removed -and -not $ws.DryRun) { Write-Ok ('Chrome on-device AI model removed (' + (Format-Bytes $r.Bytes) + ')') }
+  }
+  Write-Note "undo (Chrome downloads the model again):  $Script:WS_BROWSERAI_UNDO"
+}

package/modules/browsers.ps1

@@ -1,33 +1,101 @@
-# browsers.ps1 - section 7: browser caches for every profile. Profile data is never touched.
-
-function Get-Targets07 {
-  $P = $Script:P
-  return @(
-    (New-Target 7 'Google Chrome' "$($P.L)\Google\Chrome\User Data" -Kind chromium -Guard @('chrome') -Note 'cache folders of every profile')
-    (New-Target 7 'Google Chrome Beta' "$($P.L)\Google\Chrome Beta\User Data" -Kind chromium -Guard @('chrome'))
-    (New-Target 7 'Google Chrome Dev' "$($P.L)\Google\Chrome Dev\User Data" -Kind chromium -Guard @('chrome'))
-    (New-Target 7 'Google Chrome Canary' "$($P.L)\Google\Chrome SxS\User Data" -Kind chromium -Guard @('chrome'))
-    (New-Target 7 'Microsoft Edge' "$($P.L)\Microsoft\Edge\User Data" -Kind chromium -Guard @('msedge'))
-    (New-Target 7 'Brave' "$($P.L)\BraveSoftware\Brave-Browser\User Data" -Kind chromium -Guard @('brave'))
-    (New-Target 7 'Vivaldi' "$($P.L)\Vivaldi\User Data" -Kind chromium -Guard @('vivaldi'))
-    (New-Target 7 'Opera' "$($P.A)\Opera Software\Opera Stable" -Kind chromium -Guard @('opera'))
-    (New-Target 7 'Opera GX' "$($P.A)\Opera Software\Opera GX Stable" -Kind chromium -Guard @('opera'))
-    (New-Target 7 'Chromium' "$($P.L)\Chromium\User Data" -Kind chromium -Guard @('chrome', 'chromium'))
-    (New-Target 7 'Arc' "$($P.L)\Packages\TheBrowserCompany.Arc_*\LocalCache\Local\Arc\User Data" -Kind chromium -Guard @('Arc'))
-    (New-Target 7 'Firefox' "$($P.L)\Mozilla\Firefox\Profiles" -Kind firefox -Guard @('firefox') -Note 'cache2, startupCache, thumbnails, jumpListCache')
-    (New-Target 7 'LibreWolf' "$($P.L)\LibreWolf\Profiles" -Kind firefox -Guard @('librewolf'))
-    (New-Target 7 'Waterfox' "$($P.L)\Waterfox\Profiles" -Kind firefox -Guard @('waterfox'))
-  )
-}
-
-function Invoke-Section07 {
-  Write-SectionIntro @(
-    'Browser caches rebuild as you browse; the first page loads afterwards are a little slower. Cookies, logins,',
-    'history, bookmarks, extensions, Local Storage, IndexedDB and PWA CacheStorage are never touched.',
-    'A browser that is open right now is skipped - close it and run this section again.'
-  )
-  $targets = Get-Targets07
-  $null = Show-TargetSizes $targets
-  if (-not (Confirm-Section 'Clear browser caches now?')) { Write-Info 'skipped'; return }
-  $null = Invoke-TargetList $targets
-}
+# browsers.ps1 - section 7: browser caches for every profile. Profile data is never touched.
+# P9: --browser-profile-roots / browserProfileRoots name folders that hold Chromium user-data directories of
+# their own - automation and test profiles (the P52 kept 2.0 GB of cache in ~\.local\share\ahsan-automation\profiles,
+# 2026-11-02). Only the declared cache folders inside them are cleared (D79), and a profile a running browser
+# holds through --user-data-dir is skipped. ASCII only.
+
+function Get-DeclaredProfileDirs {
+  <# .SYNOPSIS Chromium user-data directories (a folder holding "Local State") under the declared roots, up to
+     three levels deep, never through a junction. #>
+  param([string[]] $Roots = @($Script:WS.BrowserProfileRoots))
+  $out = @()
+  $seen = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($r in $Roots) {
+    if (-not $r -or -not (Test-DirPresent $r)) { continue }
+    $stack = New-Object System.Collections.Generic.Stack[object]
+    $stack.Push(@((Get-FullPath $r), 0))
+    $visited = 0
+    while ($stack.Count -gt 0 -and $visited -lt 5000) {
+      $item = $stack.Pop(); $dir = [string]$item[0]; $depth = [int]$item[1]; $visited++
+      if (Test-PathPresent (Join-Path $dir 'Local State')) { if ($seen.Add($dir)) { $out += $dir }; continue }
+      if ($depth -ge 3) { continue }
+      foreach ($e in (Get-ChildEntries $dir)) { if ($e -is [IO.DirectoryInfo] -and -not (Test-ReparsePoint $e)) { $stack.Push(@((Remove-LongPrefix $e.FullName), ($depth + 1))) } }
+    }
+  }
+  return $out
+}
+
+function Get-UserDataDirFromCommandLine {
+  <# .SYNOPSIS The --user-data-dir a browser command line names, as a full path, or ''. Handles
+     --user-data-dir=C:\a, --user-data-dir="C:\a b" and "--user-data-dir=C:\a b". #>
+  param([string] $CommandLine)
+  $t = [string]$CommandLine
+  $v = ''
+  if ($t -match '"--user-data-dir=([^"]+)"') { $v = $Matches[1] }
+  elseif ($t -match '--user-data-dir="([^"]+)"') { $v = $Matches[1] }
+  elseif ($t -match '--user-data-dir=([^\s"]+)') { $v = $Matches[1] }
+  if (-not $v) { return '' }
+  return (Get-FullPath $v.Trim())
+}
+
+function Get-BusyUserDataDirs {
+  $set = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  try {
+    foreach ($p in @(Get-CimInstance Win32_Process -Property CommandLine -ErrorAction Stop)) {
+      $d = Get-UserDataDirFromCommandLine ([string]$p.CommandLine)
+      if ($d) { $null = $set.Add($d) }
+    }
+  } catch { $null = $_ }
+  return , $set
+}
+
+function Initialize-ProfileRootExceptions {
+  <# .SYNOPSIS Called once after the settings merge (D79): exceptions for exactly the cache folders of the user-data
+     directories under the declared roots - those folders and nothing above or beside them. #>
+  if (@($Script:WS.BrowserProfileRoots).Count -eq 0) { return }
+  $leaves = @()
+  foreach ($d in (Get-DeclaredProfileDirs)) { $leaves += @(Get-ChromiumCacheDirs $d) }
+  $n = Add-CacheLeafExceptions -Paths $leaves
+  if ($n -gt 0) { Write-LogLine "D79: $n cache folder(s) under the declared browser-profile roots may be cleared" }
+}
+
+function Get-Targets07 {
+  $P = $Script:P
+  $t = @(
+    (New-Target 7 'Google Chrome' "$($P.L)\Google\Chrome\User Data" -Kind chromium -Guard @('chrome') -Note 'cache folders of every profile')
+    (New-Target 7 'Google Chrome Beta' "$($P.L)\Google\Chrome Beta\User Data" -Kind chromium -Guard @('chrome'))
+    (New-Target 7 'Google Chrome Dev' "$($P.L)\Google\Chrome Dev\User Data" -Kind chromium -Guard @('chrome'))
+    (New-Target 7 'Google Chrome Canary' "$($P.L)\Google\Chrome SxS\User Data" -Kind chromium -Guard @('chrome'))
+    (New-Target 7 'Microsoft Edge' "$($P.L)\Microsoft\Edge\User Data" -Kind chromium -Guard @('msedge'))
+    (New-Target 7 'Brave' "$($P.L)\BraveSoftware\Brave-Browser\User Data" -Kind chromium -Guard @('brave'))
+    (New-Target 7 'Vivaldi' "$($P.L)\Vivaldi\User Data" -Kind chromium -Guard @('vivaldi'))
+    (New-Target 7 'Opera' "$($P.A)\Opera Software\Opera Stable" -Kind chromium -Guard @('opera'))
+    (New-Target 7 'Opera GX' "$($P.A)\Opera Software\Opera GX Stable" -Kind chromium -Guard @('opera'))
+    (New-Target 7 'Chromium' "$($P.L)\Chromium\User Data" -Kind chromium -Guard @('chrome', 'chromium'))
+    (New-Target 7 'Arc' "$($P.L)\Packages\TheBrowserCompany.Arc_*\LocalCache\Local\Arc\User Data" -Kind chromium -Guard @('Arc'))
+    (New-Target 7 'Firefox' "$($P.L)\Mozilla\Firefox\Profiles" -Kind firefox -Guard @('firefox') -Note 'cache2, startupCache, thumbnails, jumpListCache')
+    (New-Target 7 'LibreWolf' "$($P.L)\LibreWolf\Profiles" -Kind firefox -Guard @('librewolf'))
+    (New-Target 7 'Waterfox' "$($P.L)\Waterfox\Profiles" -Kind firefox -Guard @('waterfox'))
+  )
+  foreach ($d in (Get-DeclaredProfileDirs)) {
+    $t += (New-Target 7 "Declared browser profile ($(Split-Path -Leaf $d))" $d -Kind chromium -Note 'from --browser-profile-roots; skipped while a browser holds it')
+  }
+  return $t
+}
+
+function Invoke-Section07 {
+  Write-SectionIntro @(
+    'Browser caches rebuild as you browse; the first page loads afterwards are a little slower. Cookies, logins,',
+    'history, bookmarks, extensions, Local Storage, IndexedDB and PWA CacheStorage are never touched.',
+    'A browser that is open right now is skipped - close it and run this section again.'
+  )
+  $declared = @(Get-DeclaredProfileDirs)
+  $busy = $null
+  if ($declared.Count -gt 0) { $busy = Get-BusyUserDataDirs }
+  $targets = @(Get-Targets07 | Where-Object {
+      if ($null -ne $busy -and $declared -contains $_.Path -and $busy.Contains($_.Path)) { Write-Warn "$($_.Label) - skipped: a running browser holds this profile"; $false } else { $true }
+    })
+  $null = Show-TargetSizes $targets
+  if (-not (Confirm-Section 'Clear browser caches now?')) { Write-Info 'skipped'; return }
+  $null = Invoke-TargetList $targets
+}

package/modules/data_scanner.ps1

@@ -0,0 +1,158 @@
+# data_scanner.ps1 - section 19 (P9 data scanner): large or old personal files. Downloads by default; folders a
+# person adds with --personal-roots / personalRoots (owner, 2026-11-03). Discovery is read-only and lists each file
+# once with its reason (large: >= --large-file-mb at any age; old: idle --days at any size; both), its age and the
+# timestamps that age came from (D82). Removal stays interactive: exact paths only, never by --yes, Recycle Bin by
+# default, and every file is re-checked right before it goes - one that changed since the scan, or whose path now
+# runs through a link, is refused. Personal paths never leave the machine. ASCII only.
+
+$Script:WS_DATA_SCAN_MAX_FILES = 200000   # walked per root before the scan stops and says so
+$Script:WS_DATA_SCAN_MAX_ROWS = 500       # offered at once, largest first
+
+function Test-PersonalRoot {
+  <# .SYNOPSIS Why a folder may not be a personal-data root, or $null when it may. #>
+  param([string] $Path)
+  $f = Get-FullPath $Path
+  if (-not $f) { return 'unresolvable path' }
+  if ($f -match '^[A-Za-z]:\\?$') { return 'a drive root' }
+  $info = Get-ItemInfo $f
+  if (-not ($info -is [IO.DirectoryInfo])) { return 'not an existing folder' }
+  if (Test-ReparsePoint $info) { return 'a link - add the folder it points to instead' }
+  $P = $Script:P
+  if ($f.Equals($P.U, [StringComparison]::OrdinalIgnoreCase)) { return 'the profile folder itself' }
+  foreach ($sys in @($P.SR, $P.PF, $P.PF86, $P.PD, (Join-Path $P.U 'AppData'))) {
+    if ($sys -and (Test-PathWithin -Path $f -Within $sys)) { return "inside a system, program or app-data folder ($sys)" }
+  }
+  return (Get-ProtectionReason $f)
+}
+
+function Get-PersonalDataRoots {
+  <# .SYNOPSIS Downloads plus the accepted --personal-roots, once each; every root's verdict is kept for --json. #>
+  $ws = $Script:WS
+  $report = @(); $out = @()
+  $cands = @()
+  $dl = Join-Path $Script:P.U 'Downloads'
+  if (Test-DirPresent $dl) { $cands += (Get-FullPath $dl) }
+  $cands += @($ws.PersonalRoots)
+  foreach ($c in $cands) {
+    $f = Get-FullPath $c
+    if (-not $f -or $out -contains $f -or @($report | Where-Object { $_.path -eq $f }).Count -gt 0) { continue }
+    $why = Test-PersonalRoot $f
+    $report += [ordered]@{ path = $f; accepted = (-not $why); reason = [string]$why }
+    if ($why) { Write-Warn "not scanned: $f ($why)" } else { $out += $f }
+  }
+  $ws.PersonalRootsReport = $report
+  return $out
+}
+
+function Find-PersonalFiles {
+  <# .SYNOPSIS Read-only: files under the roots that are large (>= MinBytes, any age) or old (idle >= Days, any
+     size), each once. Rows carry Selectable = $false and SkipReason when the chokepoint would refuse the file. #>
+  param([string[]] $Roots, [long] $MinBytes, [int] $Days, [int] $MaxFiles = $Script:WS_DATA_SCAN_MAX_FILES)
+  $rows = New-Object System.Collections.Generic.List[object]
+  $now = [datetime]::UtcNow
+  foreach ($root in $Roots) {
+    $ignore = Test-LastAccessLive -Root $root
+    $basis = 'write+access'
+    if ($ignore) { $basis = 'write' }
+    $files = @(Get-FilesUnder -Root $root -MaxDepth 6 -MaxFiles $MaxFiles)
+    if ($files.Count -ge $MaxFiles) { Write-Note "stopped after $MaxFiles files under $root - add a narrower folder for the rest" }
+    foreach ($f in $files) {
+      $len = [long]$f.Length
+      $t = Get-NewestTimestampUtc $f -IgnoreAccess:$ignore
+      $age = [int][math]::Floor(($now - $t).TotalDays)
+      $large = ($len -ge $MinBytes); $old = ($age -ge $Days)
+      if (-not ($large -or $old)) { continue }
+      $reason = 'old'
+      if ($large -and $old) { $reason = 'both' } elseif ($large) { $reason = 'large' }
+      $path = Remove-LongPrefix $f.FullName
+      $why = Get-ProtectionReason $path
+      $rows.Add([pscustomobject]@{ Path = $path; Root = $root; Bytes = $len; Idle = $age; Reason = $reason; Basis = $basis
+          Modified = $t; Written = $f.LastWriteTimeUtc; Selectable = (-not $why); SkipReason = [string]$why })
+    }
+  }
+  return $rows.ToArray()
+}
+
+function Test-PersonalFileUnchanged {
+  <# .SYNOPSIS Right before removal: why the file may no longer go - gone, now a link, changed since the scan, or
+     reached through a folder that became a link - or $null when it is exactly what the scan saw. #>
+  param([pscustomobject] $Row)
+  $info = Get-ItemInfo $Row.Path
+  if (-not ($info -is [IO.FileInfo])) { return 'gone, or no longer a file' }
+  if (Test-ReparsePoint $info) { return 'it became a link' }
+  if ([long]$info.Length -ne [long]$Row.Bytes -or $info.LastWriteTimeUtc -ne $Row.Written) { return 'changed since the scan - scan again' }
+  $root = Get-FullPath $Row.Root
+  $rootInfo = Get-ItemInfo $root
+  if (-not ($rootInfo -is [IO.DirectoryInfo]) -or (Test-ReparsePoint $rootInfo)) { return 'its folder is gone or became a link' }
+  $dir = $info.Directory
+  while ($null -ne $dir -and -not (Get-FullPath $dir.FullName).Equals($root, [StringComparison]::OrdinalIgnoreCase)) {
+    if (Test-ReparsePoint $dir) { return 'a folder on its path became a link' }
+    $dir = $dir.Parent
+  }
+  if ($null -eq $dir) { return 'no longer inside its folder' }
+  return $null
+}
+
+function Show-DataScanTable {
+  param([object[]] $Rows)
+  Write-UiLine ("  {0,3}  {1,10} {2,6}  {3,-5}  {4}" -f '#', 'SIZE', 'AGE', 'WHY', 'FILE') 'White'
+  $i = 1
+  foreach ($r in $Rows) { Write-UiLine ("  {0,3}  {1,10} {2,5}d  {3,-5}  {4}" -f $i, (Format-Bytes $r.Bytes), $r.Idle, $r.Reason, $r.Path) 'Gray'; $i++ }
+}
+
+function Get-Targets19 {
+  $t = @()
+  foreach ($r in @(Join-Path $Script:P.U 'Downloads') + @($Script:WS.PersonalRoots)) {
+    if ($r -and (Test-DirPresent $r)) { $t += (New-Target 19 "Files >= $($Script:WS.LargeFileMb) MB, or idle $($Script:WS.Days)+ days" (Get-FullPath $r) -Kind cmd -Note 'moved to the Recycle Bin after you pick them') }
+  }
+  return $t
+}
+
+function Invoke-Section19 {
+  $ws = $Script:WS
+  Write-SectionIntro @(
+    "Files in Downloads and the folders you added that are large ($($ws.LargeFileMb) MB or more, any age) or old (untouched for",
+    "$($ws.Days)+ days, any size). Large and old describe the file, not whether you still need it. You pick what goes;",
+    'it lands in the Recycle Bin, and a file that changed since this list was made is refused.'
+  )
+  $roots = @(Get-PersonalDataRoots)
+  if ($roots.Count -eq 0) { Write-Info 'no folder to scan (no Downloads folder, and no accepted --personal-roots)'; return }
+  $all = @(Find-PersonalFiles -Roots $roots -MinBytes ([long]$ws.LargeFileMb * 1MB) -Days $ws.Days)
+  foreach ($k in @($all | Where-Object { -not $_.Selectable })) {
+    Write-Note ("kept: {0}  ({1})" -f $k.Path, $k.SkipReason)
+    Add-JsonCandidate -Section 19 -Index 0 -Path $k.Path -Bytes $k.Bytes -IdleDays $k.Idle -Extra ([ordered]@{ reason = $k.Reason; age_basis = $k.Basis; modified = $k.Modified.ToString('o'); root = $k.Root; selectable = $false; skip_reason = $k.SkipReason })
+  }
+  $offer = @($all | Where-Object { $_.Selectable } | Sort-Object Bytes -Descending)
+  if ($offer.Count -gt $Script:WS_DATA_SCAN_MAX_ROWS) { Write-Note ("{0} more matching files are not listed (the smallest) - raise --large-file-mb or --days to see others" -f ($offer.Count - $Script:WS_DATA_SCAN_MAX_ROWS)); $offer = @($offer | Select-Object -First $Script:WS_DATA_SCAN_MAX_ROWS) }
+  if ($offer.Count -eq 0) { Write-Info 'no large or old file found'; return }
+  Show-DataScanTable $offer
+  $i = 1; $total = [long]0
+  foreach ($r in $offer) {
+    Add-JsonCandidate -Section 19 -Index $i -Path $r.Path -Bytes $r.Bytes -IdleDays $r.Idle -Extra ([ordered]@{ reason = $r.Reason; age_basis = $r.Basis; modified = $r.Modified.ToString('o'); root = $r.Root; selectable = $true })
+    $total += $r.Bytes; $i++
+  }
+  Write-Info ('total: ' + (Format-Bytes $total))
+  $dest = 'the Recycle Bin'
+  if ($ws.Permanent) { Write-Note '--permanent does not apply to personal files in section 19' }
+  Write-Note "selected files go to $dest"
+  $picks = @(Read-MultiSelect -Total $offer.Count -NoAutoYes -Candidates @($offer | ForEach-Object { $_.Path }))
+  if ($picks.Count -eq 0) { Write-Info 'nothing selected'; return }
+  if (-not $ws.DryRun) {
+    if (-not (Confirm-Ui -Prompt "Move the selected files to $dest ($($picks.Count) file(s))?" -Default 'n' -NoAutoYes -ScriptedOk)) { Write-Info 'skipped'; return }
+  }
+  foreach ($k in $picks) {
+    $row = $offer[$k - 1]
+    $changed = Test-PersonalFileUnchanged $row
+    if ($changed) { Write-Warn "kept $($row.Path) - $changed"; continue }
+    $null = Send-ToRecycleBin -Path $row.Path -Within $row.Root -AlwaysRecycle
+  }
+}
+
+function Show-DataScan {
+  <# .SYNOPSIS Read-only listing of section 19 for --scan. #>
+  $ws = $Script:WS
+  Write-Section "Files >= $($ws.LargeFileMb) MB, or idle $($ws.Days)+ days, in Downloads and your added folders"
+  $roots = @(Get-PersonalDataRoots)
+  $rows = @(Find-PersonalFiles -Roots $roots -MinBytes ([long]$ws.LargeFileMb * 1MB) -Days $ws.Days | Where-Object { $_.Selectable } | Sort-Object Bytes -Descending)
+  if ($rows.Count -eq 0) { Write-Info 'none found' } else { Show-DataScanTable @($rows | Select-Object -First 30) }
+}

package/modules/globals_audit.ps1

@@ -58,11 +58,12 @@ function Get-GlobalPackages {
   <# .SYNOPSIS Packages under one global root. Reads each package.json (top level only) - never walks a global tree. #>
   param([pscustomobject] $RootRow)
   $rows = @()
+  $ignore = Test-LastAccessLive -Root $RootRow.Root
   if ($RootRow.Style -eq 'bin') {
     foreach ($e in (Get-ChildEntries $RootRow.Root)) {
       if ($e -is [IO.DirectoryInfo]) { continue }
       if ($e.Extension -eq '.cmd') { continue }
-      $idle = [int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $e)).TotalDays)
+      $idle = [int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $e -IgnoreAccess:$ignore)).TotalDays)
       $rows += [pscustomobject]@{ Manager = $RootRow.Manager; Name = [IO.Path]::GetFileNameWithoutExtension($e.Name)
         Version = ''; Path = (Remove-LongPrefix $e.FullName); Bytes = [long]$e.Length; Idle = $idle
         Bins = @([IO.Path]::GetFileNameWithoutExtension($e.Name)) }
@@ -89,7 +90,7 @@ function Get-GlobalPackages {
     if ($manifest -and $manifest.version) { $version = [string]$manifest.version }
     # The newest of the package's own top-level entries: a global node_modules is far too big to walk.
     $newest = [datetime]::MinValue
-    foreach ($c in (Get-ChildEntries $d.Dir)) { $t = Get-NewestTimestampUtc $c; if ($t -gt $newest) { $newest = $t } }
+    foreach ($c in (Get-ChildEntries $d.Dir)) { $t = Get-NewestTimestampUtc $c -IgnoreAccess:$ignore; if ($t -gt $newest) { $newest = $t } }
     if ($newest -eq [datetime]::MinValue) { $newest = [datetime]::UtcNow }
     $rows += [pscustomobject]@{ Manager = $RootRow.Manager; Name = $d.Name; Version = $version; Path = $d.Dir
       Bytes = [long](Get-DirectoryBytes $d.Dir); Idle = [int][math]::Floor(([datetime]::UtcNow - $newest).TotalDays)
@@ -107,6 +108,7 @@ function Get-ProjectPackageIndex {
   $script = New-Object System.Text.StringBuilder
   $seen = 0
   foreach ($root in $Roots) {
+    $ignore = Test-LastAccessLive -Root $root
     $stack = New-Object System.Collections.Generic.Stack[object]
     $stack.Push(@($root, 0))
     while ($stack.Count -gt 0 -and $seen -lt $MaxFiles) {
@@ -125,7 +127,7 @@ function Get-ProjectPackageIndex {
         }
         if ($e.Name -ne 'package.json') { continue }
         $seen++
-        if ([int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $e)).TotalDays) -ge $Days) { continue }
+        if ([int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $e -IgnoreAccess:$ignore)).TotalDays) -ge $Days) { continue }
         $m = $null
         try { $m = @(Read-JsonFile (Remove-LongPrefix $e.FullName))[0] } catch { $m = $null }
         if ($null -eq $m) { continue }

package/modules/installed_programs.ps1

@@ -51,6 +51,65 @@ function Get-InstallLocationIdleDays {
   return [int][math]::Floor(([datetime]::UtcNow - $newest).TotalDays)
 }
 
+function ConvertFrom-PrefetchName {
+  <# .SYNOPSIS "CHROME.EXE-1A2B3C4D.pf" -> "chrome.exe"; '' for anything else. #>
+  param([string] $Name)
+  if ($Name -match '^(.+\.exe)-[0-9A-Fa-f]{8}\.pf$') { return $Matches[1].ToLowerInvariant() }
+  return ''
+}
+
+function Get-PrefetchLastRun {
+  <# .SYNOPSIS P9: program file name -> newest run (UTC) from Windows\Prefetch, which Windows rewrites on every
+     run. Readable only when elevated; empty otherwise or when prefetch is off. #>
+  $map = @{}
+  if (-not $Script:WS.IsAdmin) { return $map }
+  foreach ($e in (Get-ChildEntries (Join-Path $Script:P.SR 'Prefetch'))) {
+    if (-not ($e -is [IO.FileInfo])) { continue }
+    $exe = ConvertFrom-PrefetchName $e.Name
+    if ($exe -and (-not $map.ContainsKey($exe) -or $e.LastWriteTimeUtc -gt $map[$exe])) { $map[$exe] = $e.LastWriteTimeUtc }
+  }
+  return $map
+}
+
+function Get-InstallLocationExeNames {
+  <# .SYNOPSIS Program file names (lower case) at depth <= 2 under an install folder, never through a junction. #>
+  param([string] $Location, [int] $MaxEntries = 4000)
+  $names = @()
+  if ([string]::IsNullOrWhiteSpace($Location)) { return $names }
+  $root = Get-FullPath ($Location.Trim().Trim('"').TrimEnd('\'))
+  if (-not $root -or -not (Test-DirPresent $root)) { return $names }
+  $stack = New-Object System.Collections.Generic.Stack[object]
+  $stack.Push(@($root, 0))
+  $seen = 0
+  while ($stack.Count -gt 0 -and $seen -lt $MaxEntries) {
+    $item = $stack.Pop()
+    foreach ($e in (Get-ChildEntries ([string]$item[0]))) {
+      $seen++
+      if (Test-ReparsePoint $e) { continue }
+      if ($e -is [IO.DirectoryInfo]) { if ([int]$item[1] -lt 2) { $stack.Push(@((Remove-LongPrefix $e.FullName), ([int]$item[1] + 1))) }; continue }
+      if ($e.Name -like '*.exe') { $names += $e.Name.ToLowerInvariant() }
+    }
+  }
+  return $names
+}
+
+# Prefetch keys a run by file name only, so a name many programs ship says nothing about this one: Steam's
+# uninstall.exe running made FileZilla (which also ships uninstall.exe) look "ran today" (P52, 2026-11-03).
+$Script:WS_PREFETCH_GENERIC = '^(unins\d*|uninst.*|uninstall.*|update.*|updater.*|setup.*|install.*|crash.*|elevate.*|helper.*|maintenancetool|au_|launcher|bootstrap.*|vc_redist.*|notification_helper|squirrel)\.exe$'
+
+function Get-LastRunDays {
+  <# .SYNOPSIS Pure: days since the newest Prefetch run of any of these program files - generic names (uninstall.exe,
+     update.exe, setup.exe, crash handlers) never count - or -1 when none ran. #>
+  param([string[]] $ExeNames, [hashtable] $Prefetch, [datetime] $NowUtc = [datetime]::UtcNow)
+  $best = [datetime]::MinValue
+  foreach ($n in @($ExeNames)) {
+    if ($n -match $Script:WS_PREFETCH_GENERIC) { continue }
+    if ($Prefetch.ContainsKey($n) -and $Prefetch[$n] -gt $best) { $best = $Prefetch[$n] }
+  }
+  if ($best -eq [datetime]::MinValue) { return -1 }
+  return [int][math]::Floor(($NowUtc - $best).TotalDays)
+}
+
 function Get-ProgramRemovalHint {
   <# .SYNOPSIS The command that removes a program: winget when it knows it, otherwise its own UninstallString. #>
   param([pscustomobject] $Row, [hashtable] $WingetMap)
@@ -86,11 +145,19 @@ function Invoke-Section24 {
   if ($scored.Count -eq 0) {
     Write-Info "no installed program has been untouched for $($ws.Days)+ days"
   } else {
-    Write-UiLine ("  {0,-44} {1,-14} {2,10} {3,6}  {4}" -f 'PROGRAM', 'VERSION', 'SIZE', 'IDLE', 'PUBLISHER') 'White'
+    $prefetch = Get-PrefetchLastRun
+    if ($prefetch.Count -gt 0) { Write-Note 'RAN = days since Windows Prefetch last saw one of its program files run; "none" means no run is on record (Prefetch keeps about 1,024 programs)' }
+    else { Write-Note 'RAN needs an elevated run (Windows Prefetch): windowsweep --only 24 --elevate' }
+    Write-UiLine ("  {0,-44} {1,-14} {2,10} {3,6} {4,6}  {5}" -f 'PROGRAM', 'VERSION', 'SIZE', 'IDLE', 'RAN', 'PUBLISHER') 'White'
     foreach ($s in ($scored | Sort-Object Bytes -Descending)) {
       $size = 'unknown'
       if ($s.Bytes -gt 0) { $size = Format-Bytes $s.Bytes }
-      $line = "  {0,-44} {1,-14} {2,10} {3,5}d  {4}" -f $s.Row.DisplayName, $s.Row.DisplayVersion, $size, $s.Idle, $s.Row.Publisher
+      $ran = '-'
+      if ($prefetch.Count -gt 0) {
+        $d = Get-LastRunDays -ExeNames @(Get-InstallLocationExeNames -Location $s.Row.InstallLocation) -Prefetch $prefetch
+        if ($d -ge 0) { $ran = "${d}d" } else { $ran = 'none' }
+      }
+      $line = "  {0,-44} {1,-14} {2,10} {3,5}d {4,6}  {5}" -f $s.Row.DisplayName, $s.Row.DisplayVersion, $size, $s.Idle, $ran, $s.Row.Publisher
       Write-UiLine $line 'Gray'
       $lines += $line.Trim()
       $lines += ('    remove with: ' + (Get-ProgramRemovalHint -Row $s.Row -WingetMap $winget))