windowsweep 1.3.2 → 1.4.1

package/modules/leftovers.ps1

@@ -0,0 +1,388 @@
+# leftovers.ps1 - section 27: folders uninstalled programs left in Program Files, Common Files and ProgramData
+# (D78), and the finder section 26 runs right after an uninstall. Section 23 owns the top level of AppData.
+# A folder is offered only when no installed program's name claims it, nothing registered still points into it
+# (an uninstall entry, a service or driver, an environment variable or PATH entry, a Run entry, a shortcut, a
+# scheduled task or a running process) and - in section 27 - it has been idle --days. An unreadable registry
+# offers nothing (fail closed). Picked folders go to the Recycle Bin; one inside a protected folder is only
+# reported. Seen on the P52 (2026-11-02): AVAST Software and Malwarebytes Anti-Exploit folders years after
+# their uninstall. ASCII only.
+
+# Never offered: Windows, runtime, hardware-vendor and shared folders, whatever claims them or not.
+$Script:WS_LEFTOVER_NEVER = @(
+  'Common Files', 'Internet Explorer', 'Microsoft', 'Microsoft.NET', 'Microsoft Office', 'Microsoft OneDrive', 'Microsoft SDKs',
+  'Microsoft SQL Server', 'Microsoft Update Health Tools', 'Microsoft Visual Studio', 'Microsoft Analysis Services', 'MSBuild',
+  'dotnet', 'Reference Assemblies', 'Uninstall Information', 'Windows Defender', 'Windows Defender Advanced Threat Protection',
+  'Windows Kits', 'Windows Mail', 'Windows Media Player', 'Windows Multimedia Platform', 'Windows NT', 'Windows Photo Viewer',
+  'Windows Portable Devices', 'Windows Security', 'Windows Sidebar', 'WindowsApps', 'WindowsPowerShell', 'ModifiableWindowsApps',
+  'PowerShell', 'Windows', 'WindowsHolographicDevices', 'USOPrivate', 'USOShared', 'SoftwareDistribution', 'ssh', 'Packages',
+  'Package Cache', 'regid.1991-06.com.microsoft', 'Comms', 'Application Data', 'Desktop', 'Documents', 'Start Menu',
+  'Templates', 'Favorites', 'DeviceSync', 'Temp', 'Tmp', 'IIS', 'IIS Express', 'Intel', 'NVIDIA', 'NVIDIA Corporation', 'AMD',
+  # Shared Microsoft components and install caches, and a fingerprint driver's data - offered on the P52 (2026-11-03)
+  'MSECache', 'MSOCache', 'DESIGNER', 'Microsoft Shared', 'System', 'Services', 'SpeechEngines', 'InstallShield',
+  'InstallShield Installation Information', 'Windows Live', 'Validity',
+  'ATI Technologies', 'Realtek', 'Synaptics', 'Lenovo', 'Dell', 'HP', 'Hewlett-Packard', 'Thunderbolt', 'Conexant', 'Dolby',
+  'Waves', 'Qualcomm', 'Broadcom', 'Killer Networking', 'Rivet Networks', 'Elantech', 'Alps', 'Bonjour', 'Apple', 'Google',
+  'Mozilla', 'Oracle', 'Java', 'Git', 'nodejs', 'Python', 'WSL', 'windowsweep', 'com.aoneahsan.windowsweep'
+)
+# Words too common to tie a folder to one program: never used as a program's key name.
+$Script:WS_LEFTOVER_STOPWORDS = @('corporation', 'corp', 'software', 'systems', 'system', 'technologies', 'technology', 'limited',
+  'company', 'group', 'studio', 'studios', 'microsoft', 'windows', 'google', 'apps', 'tools', 'tool', 'program', 'programs', 'data',
+  'update', 'updater', 'setup', 'desktop', 'free', 'easy', 'best', 'simple', 'smart', 'super', 'quick', 'total', 'advanced',
+  'auto', 'mini', 'open', 'global', 'universal', 'portable', 'online', 'digital', 'power', 'master', 'magic', 'ultimate',
+  'express', 'visual', 'version', 'edition', 'professional', 'enterprise', 'community', 'client', 'server', 'service',
+  'services', 'helper', 'player', 'manager', 'runtime', 'driver', 'drivers', 'support', 'common', 'files', 'shared')
+
+function Get-CommandPaths {
+  <# .SYNOPSIS The absolute paths a registered command names - its program and any absolute path among its
+     arguments - with environment variables expanded and the kernel forms (\SystemRoot\, \??\, system32\) resolved. #>
+  param([string] $Text)
+  $t = [Environment]::ExpandEnvironmentVariables(([string]$Text).Trim())
+  if (-not $t) { return @() }
+  $t = $t -replace '^\\\?\?\\', ''
+  if ($t -match '^\\SystemRoot\\(.*)$') { $t = Join-Path $Script:P.SR $Matches[1] }
+  elseif ($t -match '^(system32|syswow64)\\') { $t = Join-Path $Script:P.SR $t }
+  $c = Split-CommandLine $t
+  $out = @($c.FilePath)
+  foreach ($m in [regex]::Matches([string]$c.Arguments, '"([A-Za-z]:\\[^"]+)"|(?<![^\s,=])([A-Za-z]:\\[^\s",]+)')) {
+    $v = $m.Groups[1].Value
+    if (-not $v) { $v = $m.Groups[2].Value }
+    $out += $v
+  }
+  return @($out | Where-Object { $_ -match '^[A-Za-z]:\\' })
+}
+
+function Get-ShortcutTargets {
+  <# .SYNOPSIS Targets of the Start Menu, desktop and pinned-taskbar shortcuts, for this user and all users. #>
+  $dirs = @([Environment]::GetFolderPath('StartMenu'), [Environment]::GetFolderPath('CommonStartMenu'),
+    [Environment]::GetFolderPath('Desktop'), [Environment]::GetFolderPath('CommonDesktopDirectory'),
+    (Join-Path $Script:P.A 'Microsoft\Internet Explorer\Quick Launch'))
+  $out = New-Object System.Collections.Generic.List[string]
+  $shell = $null
+  try { $shell = New-Object -ComObject WScript.Shell } catch { return @() }
+  try {
+    foreach ($d in $dirs) {
+      if (-not $d -or -not (Test-DirPresent $d)) { continue }
+      foreach ($f in @(Get-ChildItem -LiteralPath $d -Recurse -Filter '*.lnk' -File -ErrorAction SilentlyContinue | Select-Object -First 3000)) {
+        try { $target = [string]$shell.CreateShortcut($f.FullName).TargetPath; if ($target) { $out.Add($target) } } catch { $null = $_ }
+      }
+    }
+  } finally { try { $null = [Runtime.InteropServices.Marshal]::ReleaseComObject($shell) } catch { $null = $_ } }
+  return $out.ToArray()
+}
+
+function Get-ComServerPaths {
+  <# .SYNOPSIS Files registered COM servers and type libraries load (machine 64- and 32-bit, and this user). Office
+     2007's add-in designer in Common Files\DESIGNER is registered only this way (P52, 2026-11-03). #>
+  $out = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($v in @(@('LocalMachine', 'Registry64'), @('LocalMachine', 'Registry32'), @('CurrentUser', 'Default'))) {
+    $base = $null
+    try { $base = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]$v[0], [Microsoft.Win32.RegistryView]$v[1]) } catch { continue }
+    try {
+      $clsid = $base.OpenSubKey('SOFTWARE\Classes\CLSID')
+      if ($clsid) {
+        foreach ($name in $clsid.GetSubKeyNames()) {
+          foreach ($sub in 'InprocServer32', 'LocalServer32') {
+            $k = $null
+            try { $k = $clsid.OpenSubKey("$name\$sub") } catch { $k = $null }
+            if ($k) { $val = [string]$k.GetValue(''); $k.Close(); if ($val) { $null = $out.Add($val) } }
+          }
+        }
+        $clsid.Close()
+      }
+      $tl = $base.OpenSubKey('SOFTWARE\Classes\TypeLib')
+      if ($tl) {
+        foreach ($g in $tl.GetSubKeyNames()) {
+          $gk = $null
+          try { $gk = $tl.OpenSubKey($g) } catch { $gk = $null }
+          if (-not $gk) { continue }
+          foreach ($ver in $gk.GetSubKeyNames()) {
+            foreach ($lcid in @(try { $gk.OpenSubKey($ver).GetSubKeyNames() } catch { @() })) {
+              foreach ($plat in 'win32', 'win64') {
+                $pk = $null
+                try { $pk = $gk.OpenSubKey("$ver\$lcid\$plat") } catch { $pk = $null }
+                if ($pk) { $val = [string]$pk.GetValue(''); $pk.Close(); if ($val) { $null = $out.Add($val) } }
+              }
+            }
+          }
+          $gk.Close()
+        }
+        $tl.Close()
+      }
+    } catch { $null = $_ } finally { $base.Close() }
+  }
+  return @($out)
+}
+
+function Expand-ShortPath {
+  <# .SYNOPSIS C:\PROGRA~2\COMMON~1\x -> C:\Program Files (x86)\Common Files\x. COM registrations often store 8.3
+     names; a claim must compare with the long path a folder is listed by. Unchanged when it cannot resolve. #>
+  param([string] $Path)
+  if ($Path -notmatch '~') { return $Path }
+  $parts = $Path.Split('\')
+  $cur = $parts[0] + '\'
+  for ($i = 1; $i -lt $parts.Count; $i++) {
+    $seg = $parts[$i]
+    if (-not $seg) { continue }
+    if ($seg.Contains('~')) {
+      try { $hit = @(([IO.DirectoryInfo]$cur).GetFileSystemInfos($seg)); if ($hit.Count -eq 1) { $seg = $hit[0].Name } } catch { return $Path }
+    }
+    $cur = Join-Path $cur $seg
+  }
+  return $cur
+}
+
+function Get-LeftoverClaims {
+  <# .SYNOPSIS What still claims a folder. Names: the installed-program index without the folders being judged.
+     Paths: existing files and folders an uninstall entry, a service or driver, an environment variable (PATH
+     included), a Run entry, a shortcut, a scheduled task or a running process names. #>
+  param([string[]] $IgnorePaths = @())
+  $index = Get-InstalledProgramIndex -IgnorePaths $IgnorePaths
+  $raw = New-Object System.Collections.Generic.List[string]
+  foreach ($r in $index.Rows) {
+    if ($r.InstallLocation) { $raw.Add(([string]$r.InstallLocation).Trim().Trim('"')) }
+    foreach ($s in @($r.UninstallString, $r.QuietUninstallString)) { if ($s) { foreach ($x in (Get-CommandPaths $s)) { $raw.Add($x) } } }
+  }
+  foreach ($cls in 'Win32_Service', 'Win32_SystemDriver') {
+    try { foreach ($s in @(Get-CimInstance $cls -Property PathName -ErrorAction Stop)) { foreach ($x in (Get-CommandPaths ([string]$s.PathName))) { $raw.Add($x) } } } catch { $null = $_ }
+  }
+  foreach ($scope in 'Machine', 'User') {
+    try {
+      $vars = [Environment]::GetEnvironmentVariables($scope)
+      foreach ($k in @($vars.Keys)) {
+        foreach ($part in ([string]$vars[$k] -split ';')) { $v = [Environment]::ExpandEnvironmentVariables($part.Trim().Trim('"')); if ($v -match '^[A-Za-z]:\\') { $raw.Add($v) } }
+      }
+    } catch { $null = $_ }
+  }
+  foreach ($key in @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
+      'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
+      'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')) {
+    try {
+      $item = Get-ItemProperty -LiteralPath $key -ErrorAction Stop
+      foreach ($prop in $item.PSObject.Properties) { if ($prop.Name -notlike 'PS*') { foreach ($x in (Get-CommandPaths ([string]$prop.Value))) { $raw.Add($x) } } }
+    } catch { $null = $_ }
+  }
+  foreach ($x in (Get-ShortcutTargets)) { $raw.Add($x) }
+  foreach ($x in (Get-ComServerPaths)) { foreach ($y in (Get-CommandPaths $x)) { $raw.Add($y) } }
+  try {
+    foreach ($task in @(Get-ScheduledTask -ErrorAction Stop)) {
+      foreach ($a in @($task.Actions)) {
+        if ($a.Execute) { foreach ($x in (Get-CommandPaths ('"' + ([string]$a.Execute).Trim('"') + '" ' + [string]$a.Arguments))) { $raw.Add($x) } }
+      }
+    }
+  } catch { $null = $_ }
+  try {
+    foreach ($proc in @(Get-CimInstance Win32_Process -Property ExecutablePath, CommandLine -ErrorAction Stop)) {
+      if ($proc.ExecutablePath) { $raw.Add([string]$proc.ExecutablePath) }
+      if ($proc.CommandLine) { foreach ($x in (Get-CommandPaths ([string]$proc.CommandLine))) { $raw.Add($x) } }
+    }
+  } catch { $null = $_ }
+  $set = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($r in $raw) {
+    $f = ''
+    try { $f = Expand-ShortPath (Get-FullPath $r) } catch { $f = '' }
+    if ($f -and -not $set.Contains($f) -and (Test-Path -LiteralPath $f)) { $null = $set.Add($f) }
+  }
+  return [pscustomobject]@{ Tokens = $index.Tokens; RegistryCount = $index.RegistryCount; Rows = $index.Rows; Paths = @($set) }
+}
+
+function Test-LeftoverClaimed {
+  <# .SYNOPSIS Why a folder still belongs to something, or $null when nothing claims it. #>
+  param([string] $Path, [pscustomobject] $Claims)
+  if (-not (Test-OrphanFolderName -Name (Split-Path -Leaf $Path) -Index $Claims)) { return 'its name belongs to an installed program' }
+  $prefix = $Path.TrimEnd('\') + '\'
+  foreach ($c in $Claims.Paths) {
+    if ($c.Equals($Path, [StringComparison]::OrdinalIgnoreCase) -or $c.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) { return "still in use: $c" }
+  }
+  return $null
+}
+
+function Get-LeftoverRoots {
+  <# .SYNOPSIS Where uninstalled programs leave folders. -WithAppData adds Roaming and Local - for section 26's
+     pass right after an uninstall only; section 23 owns them otherwise. #>
+  param([switch] $WithAppData)
+  $P = $Script:P
+  $roots = @($P.PF, $P.PF86, (Join-Path $P.PF 'Common Files'), (Join-Path $P.PF86 'Common Files'), $P.PD, (Join-Path $P.L 'Programs'))
+  if ($WithAppData) { $roots += @($P.A, $P.L) }
+  $seen = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  return @($roots | Where-Object { $_ -and (Test-DirPresent $_) -and $seen.Add($_) })
+}
+
+function Get-ProgramKeyTokens {
+  <# .SYNOPSIS The names a program's leftover folders carry: the first word of its name and of its publisher, its
+     whole name and its install folder's name - 4+ characters, with a letter, never a common word. #>
+  param([pscustomobject] $Program)
+  $set = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::Ordinal)
+  $texts = @()
+  foreach ($text in @($Program.DisplayName, $Program.Publisher)) {
+    $words = @(([string]$text) -split '[^A-Za-z0-9]+' | Where-Object { $_ })
+    if ($words.Count -gt 0) { $texts += $words[0] }
+    $texts += [string]$text
+  }
+  $loc = ([string]$Program.InstallLocation).Trim().Trim('"').TrimEnd('\')
+  if ($loc) { $texts += (Split-Path -Leaf $loc) }
+  foreach ($x in $texts) {
+    $t = ConvertTo-MatchToken $x
+    if ($t.Length -ge 4 -and $t -match '[a-z]' -and $Script:WS_LEFTOVER_STOPWORDS -notcontains $t) { $null = $set.Add($t) }
+  }
+  return , $set
+}
+
+function Test-NameMatchesTokens {
+  <# .SYNOPSIS A folder named exactly like a key name or starting with one ("SteamLibrary" for "steam"); for a
+     reverse-DNS name, any segment after the first. #>
+  param([string] $Name, [System.Collections.Generic.HashSet[string]] $Tokens)
+  $names = @($Name)
+  if ($Name -match '^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+){2,}$') { $names += @($Name.Split('.') | Select-Object -Skip 1) }
+  foreach ($nm in $names) {
+    $n = ConvertTo-MatchToken $nm
+    if ($n.Length -lt 4) { continue }
+    foreach ($t in $Tokens) { if ($n -eq $t -or $n.StartsWith($t)) { return $true } }
+  }
+  return $false
+}
+
+function New-NeverSet {
+  $set = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($n in @($Script:WS_LEFTOVER_NEVER + $Script:WS_ORPHAN_EXCLUDE)) { $null = $set.Add($n) }
+  return , $set
+}
+
+function Find-ProgramLeftovers {
+  <# .SYNOPSIS Section 26, after an uninstall: the removed programs' install folders, and folders in the leftover
+     roots and AppData named like them. Rows carry Reason = $null to offer, else why the folder stays. Fails
+     closed. -Roots and -Claims are for the self-test. #>
+  param([pscustomobject[]] $Programs, [string[]] $Roots = @(), [pscustomobject] $Claims = $null)
+  if ($Roots.Count -eq 0) { $Roots = @(Get-LeftoverRoots -WithAppData) }
+  $tokens = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::Ordinal)
+  foreach ($prog in @($Programs)) { foreach ($t in (Get-ProgramKeyTokens $prog)) { $null = $tokens.Add($t) } }
+  $never = New-NeverSet
+  $cand = New-Object System.Collections.Generic.List[object]
+  $seen = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($prog in @($Programs)) {
+    $loc = ([string]$prog.InstallLocation).Trim().Trim('"').TrimEnd('\')
+    if (-not $loc -or -not (Test-DirPresent $loc)) { continue }
+    $full = Get-FullPath $loc
+    if ($seen.Add($full)) { $cand.Add([pscustomobject]@{ Path = $full; Root = (Split-Path -Parent $full); Program = $prog.DisplayName; Reason = $null; Idle = -1; Bytes = [long]0 }) }
+  }
+  foreach ($root in $Roots) {
+    if ($tokens.Count -eq 0 -or -not $root -or -not (Test-DirPresent $root)) { continue }
+    foreach ($e in (Get-ChildEntries $root)) {
+      if (-not ($e -is [IO.DirectoryInfo]) -or (Test-ReparsePoint $e) -or $never.Contains($e.Name)) { continue }
+      if (-not (Test-NameMatchesTokens -Name $e.Name -Tokens $tokens)) { continue }
+      $full = Remove-LongPrefix $e.FullName
+      if ($seen.Add($full)) { $cand.Add([pscustomobject]@{ Path = $full; Root = (Get-FullPath $root); Program = ''; Reason = $null; Idle = -1; Bytes = [long]0 }) }
+    }
+  }
+  if ($cand.Count -eq 0) { return @() }
+  if ($null -eq $Claims) { $Claims = Get-LeftoverClaims -IgnorePaths @($cand | ForEach-Object { $_.Path }) }
+  if ($Claims.RegistryCount -eq 0) { Write-Warn 'no uninstall entries could be read: no folder is offered (fail closed)'; return @() }
+  foreach ($c in $cand) {
+    $why = Get-ProtectionReason $c.Path
+    if (-not $why) { $why = Test-LeftoverClaimed -Path $c.Path -Claims $Claims }
+    $c.Reason = $why
+    # Sized only when offered: a registered install folder can be a protected root such as Program Files.
+    if (-not $why) { $c.Bytes = [long](Get-DirectoryBytes $c.Path) }
+  }
+  return $cand.ToArray()   # @() around a List[object] throws "Argument types do not match" in PS 5.1
+}
+
+function Find-MachineLeftovers {
+  <# .SYNOPSIS Section 27: top-level folders in the leftover roots that nothing claims, idle -Days or more. Rows
+     carry Reason = $null to offer, else why the folder is only reported. Fails closed. #>
+  param([int] $Days, [string[]] $Roots = @(), [pscustomobject] $Claims = $null)
+  if ($Roots.Count -eq 0) { $Roots = @(Get-LeftoverRoots) }
+  $never = New-NeverSet
+  $cand = New-Object System.Collections.Generic.List[object]
+  foreach ($root in $Roots) {
+    if (-not $root -or -not (Test-DirPresent $root)) { continue }
+    foreach ($e in (Get-ChildEntries $root)) {
+      if (-not ($e -is [IO.DirectoryInfo]) -or (Test-ReparsePoint $e) -or $never.Contains($e.Name)) { continue }
+      $cand.Add([pscustomobject]@{ Path = (Remove-LongPrefix $e.FullName); Root = (Get-FullPath $root); Program = ''; Reason = $null; Idle = 0; Bytes = [long]0 })
+    }
+  }
+  if ($cand.Count -eq 0) { return @() }
+  if ($null -eq $Claims) { $Claims = Get-LeftoverClaims -IgnorePaths @($cand | ForEach-Object { $_.Path }) }
+  if ($Claims.RegistryCount -eq 0) { Write-Warn 'no uninstall entries could be read: no folder is offered (fail closed)'; return @() }
+  Write-Note "cross-checked against $($Claims.RegistryCount) installed-program entries and $(@($Claims.Paths).Count) paths still in use"
+  $out = @()
+  foreach ($c in $cand) {
+    if (Test-LeftoverClaimed -Path $c.Path -Claims $Claims) { continue }
+    $c.Idle = Get-IdleDays $c.Path
+    if ($c.Idle -lt $Days) { continue }
+    $c.Reason = Get-ProtectionReason $c.Path
+    $c.Bytes = [long](Get-DirectoryBytes $c.Path)
+    $out += $c
+  }
+  return @($out | Sort-Object Bytes -Descending | Select-Object -First 200)
+}
+
+function Invoke-LeftoverChoice {
+  <# .SYNOPSIS Report the rows that stay, list the rest, and let a person pick folders for the Recycle Bin.
+     -PathsOrConsoleOnly (section 26's second prompt): only --select-file paths or a console answer pick here - a
+     queued --select list belongs to a later prompt and is left for it. #>
+  param([object[]] $Rows, [int] $Section, [switch] $PathsOrConsoleOnly)
+  $ws = $Script:WS
+  foreach ($r in @($Rows | Where-Object { $_.Reason })) { Write-Note ("kept: {0}  ({1})" -f $r.Path, $r.Reason) }
+  $offer = @($Rows | Where-Object { -not $_.Reason })
+  if ($offer.Count -eq 0) { Write-Info 'no leftover folder can be offered'; return }
+  Write-UiLine ("  {0,3}  {1,10} {2,6}  {3}" -f '#', 'SIZE', 'IDLE', 'FOLDER') 'White'
+  $i = 1; $total = [long]0
+  foreach ($r in $offer) {
+    $idle = '-'
+    if ($r.Idle -ge 0) { $idle = "$($r.Idle)d" }
+    Write-UiLine ("  {0,3}  {1,10} {2,6}  {3}" -f $i, (Format-Bytes $r.Bytes), $idle, $r.Path) 'Gray'
+    $label = ''
+    if ($Section -eq 26) { $label = 'leftover'; if ($r.Program) { $label = "leftover: $($r.Program)" } }
+    Add-JsonCandidate -Section $Section -Index $i -Path $r.Path -Bytes $r.Bytes -IdleDays $r.Idle -Label $label
+    $total += $r.Bytes; $i++
+  }
+  Write-Info ('total: ' + (Format-Bytes $total))
+  $dest = 'the Recycle Bin'
+  if ($ws.Permanent) { $dest = 'PERMANENT deletion (--permanent)' }
+  Write-Note "selected folders go to $dest"
+  $saved = $ws.SelectQueue
+  if ($PathsOrConsoleOnly) { $ws.SelectQueue = @() }
+  try { $picks = @(Read-MultiSelect -Total $offer.Count -NoAutoYes -Candidates @($offer | ForEach-Object { $_.Path })) } finally { if ($PathsOrConsoleOnly) { $ws.SelectQueue = $saved } }
+  if ($picks.Count -eq 0) { Write-Info 'nothing selected'; return }
+  if (-not $ws.DryRun) {
+    if (-not (Confirm-Ui -Prompt "Move $($picks.Count) folder(s) to $dest ?" -Default 'n' -NoAutoYes -ScriptedOk)) { Write-Info 'skipped'; return }
+  }
+  foreach ($k in $picks) { $null = Send-ToRecycleBin -Path $offer[$k - 1].Path -Within $offer[$k - 1].Root }
+}
+
+function Get-DeadPathEntries {
+  <# .SYNOPSIS PATH entries and path-valued environment variables (machine and user) naming something that no
+     longer exists. Report only. #>
+  $out = @()
+  foreach ($scope in 'Machine', 'User') {
+    $vars = $null
+    try { $vars = [Environment]::GetEnvironmentVariables($scope) } catch { continue }
+    foreach ($k in @($vars.Keys | Sort-Object)) {
+      foreach ($part in @([string]$vars[$k] -split ';' | Where-Object { $_.Trim() })) {
+        $v = [Environment]::ExpandEnvironmentVariables($part.Trim().Trim('"'))
+        if ($v -match '^[A-Za-z]:\\' -and -not (Test-Path -LiteralPath $v)) { $out += [pscustomobject]@{ Scope = $scope; Name = [string]$k; Value = $v } }
+      }
+    }
+  }
+  return $out
+}
+
+function Get-Targets27 {
+  $P = $Script:P
+  return @((New-Target 27 'Leftover program folders' "$($P.PF) | $($P.PF86) | Common Files | $($P.PD)" -Kind cmd -Note 'you pick; idle --days; nothing installed, registered or running uses them'))
+}
+
+function Invoke-Section27 {
+  $ws = $Script:WS
+  Write-SectionIntro @(
+    'Uninstallers often leave folders in Program Files, Common Files and ProgramData. This lists the top-level',
+    'folders there that no installed program, service, driver, PATH entry, shortcut, task or running process uses',
+    "and that nothing has touched for $($ws.Days)+ days. You pick what goes; it lands in the Recycle Bin."
+  )
+  Invoke-LeftoverChoice -Rows @(Find-MachineLeftovers -Days $ws.Days) -Section 27
+  $dead = @(Get-DeadPathEntries)
+  if ($dead.Count -eq 0) { return }
+  Write-Section 'Environment entries naming something that no longer exists (report only)'
+  foreach ($d in $dead) { Write-UiLine ("  {0,-7} {1,-24} {2}" -f $d.Scope, $d.Name, $d.Value) 'Gray' }
+  Write-Note 'remove them in System Properties > Environment Variables once the tool they belonged to is gone'
+}

package/modules/orphaned_appdata.ps1

@@ -26,14 +26,36 @@ function ConvertTo-MatchToken {
 }
 
 function Add-MatchTokens {
-  <# .SYNOPSIS Add a display string to the token set: the whole thing, plus each word of 4+ characters. #>
+  <# .SYNOPSIS Add a display string to the token set: the whole thing, each word of 4+ characters, and - for a
+     name of three or more words - its initials ("Internet Download Manager" claims a folder named "IDM"). #>
   param([System.Collections.Generic.HashSet[string]] $Set, [string] $Text)
   $whole = ConvertTo-MatchToken $Text
   if ($whole.Length -ge 3) { $null = $Set.Add($whole) }
-  foreach ($w in ($Text -split '[^A-Za-z0-9]+')) {
+  $words = @($Text -split '[^A-Za-z0-9]+' | Where-Object { $_ })
+  foreach ($w in $words) {
     $t = ConvertTo-MatchToken $w
     if ($t.Length -ge 4) { $null = $Set.Add($t) }
   }
+  if ($words.Count -ge 3) {
+    $initials = (($words | ForEach-Object { $_.Substring(0, 1) }) -join '').ToLowerInvariant()
+    if ($initials.Length -ge 3) { $null = $Set.Add($initials) }
+  }
+}
+
+function Add-CommandLineTokens {
+  <# .SYNOPSIS Claim every path segment of a running command line: a tool started as "node ...\superpowers-chrome\..."
+     runs under a process named node, so its own name only ever appears here. #>
+  param([System.Collections.Generic.HashSet[string]] $Set, [string] $CommandLine)
+  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return }
+  # Only the folders of PATH arguments count. A bare word claims nothing: a shell whose command line merely
+  # mentioned "vega-desktop-updater" made that orphan look claimed on the P52 (2026-11-02).
+  foreach ($arg in ($CommandLine -split '[\s"]+')) {
+    $a = $arg.Trim("'")
+    if ($a -notmatch '^[A-Za-z]:[\\/]' -and $a -notmatch '^[\\/]{2}' -and @($a -split '[\\/]').Count -lt 3) { continue }
+    foreach ($seg in ($a -split '[\\/=]+')) {
+      if ($seg.Length -ge 4 -and -not $seg.StartsWith('-')) { Add-MatchTokens -Set $Set -Text $seg }
+    }
+  }
 }
 
 function Get-InstalledProgramRows {
@@ -56,6 +78,10 @@ function Get-InstalledProgramRows {
         Publisher = [string]$props.Publisher; InstallDate = [string]$props.InstallDate
         EstimatedSizeKb = [long]0 + $props.EstimatedSize; InstallLocation = [string]$props.InstallLocation
         UninstallString = [string]$props.UninstallString; SystemComponent = [int]0 + $props.SystemComponent
+        # Section 26 (P9) reads these; sections 23 and 24 ignore them.
+        KeyPath = [string]$k.Name; KeyName = [string]$k.PSChildName; Machine = ([string]$k.Name).StartsWith('HKEY_LOCAL_MACHINE', [StringComparison]::OrdinalIgnoreCase)
+        QuietUninstallString = [string]$props.QuietUninstallString; WindowsInstaller = [int]0 + $props.WindowsInstaller
+        ParentKeyName = [string]$props.ParentKeyName; ReleaseType = [string]$props.ReleaseType
       }
     }
   }
@@ -65,7 +91,12 @@ function Get-InstalledProgramRows {
 function Get-InstalledProgramIndex {
   <# .SYNOPSIS Everything that says "a program owns this name": uninstall entries, program folders, Store
      package names and running processes. RegistryCount drives the fail-closed gate in section 23. #>
+  # -IgnorePaths (P9, sections 26 and 27): folders being judged as leftovers, whose own names must not
+  # count as a claim on themselves.
+  param([string[]] $IgnorePaths = @())
   $P = $Script:P
+  $ignore = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::OrdinalIgnoreCase)
+  foreach ($x in $IgnorePaths) { if ($x) { $null = $ignore.Add((Get-FullPath $x)) } }
   $set = New-Object System.Collections.Generic.HashSet[string]([StringComparer]::Ordinal)
   $rows = @(Get-InstalledProgramRows)
   foreach ($r in $rows) {
@@ -75,10 +106,14 @@ function Get-InstalledProgramIndex {
   }
   foreach ($dir in @($P.PF, $P.PF86, (Join-Path $P.L 'Programs'), (Join-Path $P.L 'Microsoft\WindowsApps'), (Join-Path $P.PD 'Microsoft\Windows\Start Menu\Programs'))) {
     if (-not $dir -or -not (Test-DirPresent $dir)) { continue }
-    foreach ($e in (Get-ChildEntries $dir)) { Add-MatchTokens -Set $set -Text (($e.Name -split '_')[0]) }
+    foreach ($e in (Get-ChildEntries $dir)) {
+      if ($ignore.Count -gt 0 -and $ignore.Contains((Remove-LongPrefix $e.FullName))) { continue }
+      Add-MatchTokens -Set $set -Text (($e.Name -split '_')[0])
+    }
   }
   foreach ($e in (Get-ChildEntries (Join-Path $P.L 'Packages'))) { Add-MatchTokens -Set $set -Text (($e.Name -split '_')[0]) }
   try { foreach ($proc in (Get-Process -ErrorAction SilentlyContinue)) { Add-MatchTokens -Set $set -Text $proc.ProcessName } } catch { $null = $_ }
+  try { foreach ($proc in @(Get-CimInstance Win32_Process -ErrorAction Stop)) { Add-CommandLineTokens -Set $set -CommandLine ([string]$proc.CommandLine) } } catch { $null = $_ }
   return [pscustomobject]@{ Tokens = $set; RegistryCount = $rows.Count; Rows = $rows }
 }
 
@@ -114,6 +149,15 @@ function Test-OrphanFolderName {
   foreach ($t in $Index.Tokens) {
     if ($t.Length -lt 4) { continue }
     if ($t.StartsWith($n) -or $n.StartsWith($t)) { return $false }
+    # A shared vendor stem claims it too: "DBeaverData" belongs to the "DBeaverCorp.DBeaverCE" Store app.
+    if ($n.Length -ge 6 -and $t.Length -ge 6 -and $n.Substring(0, 6) -eq $t.Substring(0, 6)) { return $false }
+  }
+  # A reverse-DNS app id ("com.vendor.app", as Tauri and Electron apps name their data folder) is claimed when
+  # any segment after the first is: "com.aoneahsan.windowsweep" belongs to the installed "windowsweep".
+  if ($Name -match '^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+){2,}$') {
+    foreach ($seg in @($Name.Split('.') | Select-Object -Skip 1)) {
+      if ((ConvertTo-MatchToken $seg).Length -ge 4 -and -not (Test-OrphanFolderName -Name $seg -Index $Index)) { return $false }
+    }
   }
   return $true
 }

package/modules/personal.ps1

@@ -1,4 +1,5 @@
-# personal.ps1 - sections 18 and 19: personal files in Downloads. Interactive only; the Recycle Bin is the destination.
+# personal.ps1 - section 18 (partial downloads in Downloads) and the file walk section 19 shares (data_scanner.ps1).
+# Interactive only; the Recycle Bin is the destination.
 
 $Script:WS_PARTIAL_PATTERNS = @('*.crdownload', '*.part', '*.partial', '*.fdmdownload', '*.opdownload', '*.!ut', '*.aria2', '*.download', '*.bc!', '*.tmp')
 
@@ -15,15 +16,9 @@ function Get-Targets18 {
   return $t
 }
 
-function Get-Targets19 {
-  $t = @()
-  foreach ($r in (Get-PersonalRoots)) { $t += (New-Target 19 "Files >= $($Script:WS.LargeFileMb) MB idle $($Script:WS.Days)+ days" $r -Kind cmd -Note 'moved to the Recycle Bin after you pick them') }
-  return $t
-}
-
 function Get-FilesUnder {
   <# .SYNOPSIS Files under Root up to MaxDepth, never following links, never entering protected folders. #>
-  param([string] $Root, [int] $MaxDepth = 4)
+  param([string] $Root, [int] $MaxDepth = 4, [int] $MaxFiles = 0)
   $out = New-Object System.Collections.Generic.List[object]
   $stack = New-Object System.Collections.Generic.Stack[object]
   $stack.Push(@($Root, 0))
@@ -33,6 +28,7 @@ function Get-FilesUnder {
       if (Test-ReparsePoint $e) { continue }
       if ($e -is [IO.DirectoryInfo]) { if ([int]$item[1] -lt $MaxDepth) { $stack.Push(@((Remove-LongPrefix $e.FullName), [int]$item[1] + 1)) }; continue }
       $out.Add($e)
+      if ($MaxFiles -gt 0 -and $out.Count -ge $MaxFiles) { return $out }
     }
   }
   return $out
@@ -41,30 +37,16 @@ function Get-FilesUnder {
 function Get-PartialDownloads {
   $list = @()
   foreach ($root in (Get-PersonalRoots)) {
+    $ignore = Test-LastAccessLive -Root $root
     foreach ($f in (Get-FilesUnder -Root $root -MaxDepth 4)) {
       foreach ($pat in $Script:WS_PARTIAL_PATTERNS) {
-        if ($f.Name -like $pat) { $list += [pscustomobject]@{ Path = (Remove-LongPrefix $f.FullName); Bytes = [long]$f.Length; Idle = [int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $f)).TotalDays); Root = $root }; break }
+        if ($f.Name -like $pat) { $list += [pscustomobject]@{ Path = (Remove-LongPrefix $f.FullName); Bytes = [long]$f.Length; Idle = [int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $f -IgnoreAccess:$ignore)).TotalDays); Root = $root }; break }
       }
     }
   }
   return @($list | Sort-Object Bytes -Descending)
 }
 
-function Get-LargeStaleFiles {
-  $ws = $Script:WS
-  $min = [long]$ws.LargeFileMb * 1MB
-  $list = @()
-  foreach ($root in (Get-PersonalRoots)) {
-    foreach ($f in (Get-FilesUnder -Root $root -MaxDepth 4)) {
-      if ([long]$f.Length -lt $min) { continue }
-      $idle = [int][math]::Floor(([datetime]::UtcNow - (Get-NewestTimestampUtc $f)).TotalDays)
-      if ($idle -lt $ws.Days) { continue }
-      $list += [pscustomobject]@{ Path = (Remove-LongPrefix $f.FullName); Bytes = [long]$f.Length; Idle = $idle; Root = $root }
-    }
-  }
-  return @($list | Sort-Object Bytes -Descending | Select-Object -First 100)
-}
-
 function Show-FileTable {
   param([object[]] $Rows)
   Write-UiLine ("  {0,3}  {1,10} {2,6}  {3}" -f '#', 'SIZE', 'IDLE', 'FILE') 'White'
@@ -104,23 +86,11 @@ function Invoke-Section18 {
   Invoke-PersonalPicker -Rows @(Get-PartialDownloads) -Prompt 'Move the selected partial downloads to the Recycle Bin' -Section 18
 }
 
-function Invoke-Section19 {
-  $ws = $Script:WS
-  Write-SectionIntro @(
-    "Files of $($ws.LargeFileMb) MB or more in Downloads that nothing has touched for $($ws.Days)+ days: old installers, ISOs,",
-    'archives you already extracted. You pick what goes; it lands in the Recycle Bin.'
-  )
-  if (@(Get-PersonalRoots).Count -eq 0) { Write-Info 'no Downloads folder found'; return }
-  Invoke-PersonalPicker -Rows @(Get-LargeStaleFiles) -Prompt 'Move the selected files to the Recycle Bin' -Section 19
-}
-
 function Show-PersonalScan {
   <# .SYNOPSIS Read-only listing used by --scan. #>
   Write-Box 'Personal files (read-only)' 'Sections 18 and 19 are interactive only - nothing here is deleted'
   Write-Section 'Partial / orphan downloads'
   $p = @(Get-PartialDownloads)
   if ($p.Count -eq 0) { Write-Info 'none found' } else { Show-FileTable @($p | Select-Object -First 30) }
-  Write-Section "Files >= $($Script:WS.LargeFileMb) MB idle $($Script:WS.Days)+ days in Downloads"
-  $l = @(Get-LargeStaleFiles)
-  if ($l.Count -eq 0) { Write-Info 'none found' } else { Show-FileTable @($l | Select-Object -First 30) }
+  Show-DataScan
 }

package/modules/projects.ps1

@@ -63,6 +63,7 @@ function Get-ProjectActivityDays {
   <# .SYNOPSIS Days since any SOURCE file in the project changed (artefact dirs and .git excluded). #>
   param([string] $ProjectDir)
   $newest = [datetime]::MinValue
+  $ignore = Test-LastAccessLive -Root $ProjectDir
   $stack = New-Object System.Collections.Generic.Stack[string]
   $stack.Push($ProjectDir)
   $seen = 0
@@ -75,7 +76,7 @@ function Get-ProjectActivityDays {
         if ($Script:WS_ARTEFACT_DIRS -contains $e.Name -or $Script:WS_NEVER_ENTER -contains $e.Name -or (Test-MarkedArtefactDir -Dir $dir -Name $e.Name)) { continue }
         $stack.Push((Remove-LongPrefix $e.FullName)); continue
       }
-      $t = Get-NewestTimestampUtc $e
+      $t = Get-NewestTimestampUtc $e -IgnoreAccess:$ignore
       if ($t -gt $newest) { $newest = $t }
     }
   }

package/modules/runner.ps1

@@ -60,9 +60,15 @@ function Write-MachineProgress {
 
 function Add-JsonCandidate {
   <# .SYNOPSIS Record one item an interactive section offered, so --json callers can present the same list. #>
-  param([int] $Section, [int] $Index, [string] $Path, [long] $Bytes, [int] $IdleDays, [string] $Project = '')
+  param([int] $Section, [int] $Index, [string] $Path, [long] $Bytes, [int] $IdleDays, [string] $Project = '', [string] $Label = '',
+    [System.Collections.IDictionary] $Extra = $null)
   if (-not $Script:WS.JsonMode) { return }
-  $Script:WS.Candidates += [ordered]@{ section = $Section; index = $Index; path = $Path; bytes = $Bytes; idle_days = $IdleDays; project = $Project }
+  $c = [ordered]@{ section = $Section; index = $Index; path = $Path; bytes = $Bytes; idle_days = $IdleDays; project = $Project }
+  # P9: an optional display name - section 26's candidates are programs whose path is a registry key.
+  if ($Label) { $c.label = $Label }
+  # P9: section-specific fields added after the shared ones (section 19's data scanner: reason, age basis, ...).
+  if ($null -ne $Extra) { foreach ($k in $Extra.Keys) { $c[$k] = $Extra[$k] } }
+  $Script:WS.Candidates += $c
 }
 
 function Invoke-SectionById {
@@ -113,7 +119,9 @@ function Invoke-SectionById {
   $status = 'ran'
   if ($ws.DryRun) { $status = 'dry-run' }
   try {
-    & $sec.Fn
+    # A section speaks through the Write-* helpers; anything left on its output stream (a cmdlet's return value)
+    # would land on stdout ahead of the --json line, so it is discarded here for every section.
+    $null = & $sec.Fn
   } catch {
     $status = 'failed'
     Write-Err "section $Id failed: $($_.Exception.Message)"
@@ -223,7 +231,12 @@ function Get-JsonSummary {
     sections = @($ws.Report.steps | ForEach-Object { [ordered]@{ section = $_.section; status = $_.status; freed_bytes = $_.freed_bytes } })
     # candidates and targets are ALWAYS present, empty when nothing was collected: a caller can rely on the shape.
     candidates = @($ws.Candidates); targets = @($ws.ScanTargets)
-    refusals = @($ws.Refusals); excluded = @($ws.Excluded); log_file = $ws.LogFile; report_file = $ws.ReportFile
+    refusals = @($ws.Refusals); excluded = @($ws.Excluded)
+    # D82: the volumes where idle age used write/creation time because last-access was found live.
+    access_live_volumes = @(Get-AccessLiveVolumes)
+    # P9: the folders section 19 scanned or refused ({path, accepted, reason}); empty unless it ran.
+    personal_roots = @($ws.PersonalRootsReport)
+    log_file = $ws.LogFile; report_file = $ws.ReportFile
   }
 }
 
@@ -240,7 +253,18 @@ function Get-CatalogueJson {
   }
 }
 
+function Save-ElevatedSummary {
+  <# .SYNOPSIS Let the waiting non-admin parent relay an elevated child's JSON to its caller. #>
+  param([string] $Json)
+  if ($Script:WS.ElevatedChild -and $Script:WS.ElevatedSummaryToken) {
+    $path = Join-Path $Script:WS.ReportsDir ("elevated-summary-$($Script:WS.ElevatedSummaryToken).json")
+    [IO.File]::WriteAllText($path, $Json, (New-Object System.Text.UTF8Encoding($false)))
+  }
+}
+
 function Write-JsonSummary {
   <# .SYNOPSIS --json: the only line written to stdout. #>
-  [Console]::Out.WriteLine(((Get-JsonSummary) | ConvertTo-Json -Depth 5 -Compress))
+  $json = (Get-JsonSummary) | ConvertTo-Json -Depth 5 -Compress
+  Save-ElevatedSummary -Json $json
+  [Console]::Out.WriteLine($json)
 }