Validate packet capture outcomes and narrow cleanup inventory

docs/VALIDATION.md

@@ -2,10 +2,14 @@
 
 ## Completed checks
 
-Unreleased audit, 2026-09-26: seven new cleanup regressions pass in Windows PowerShell 5.1, covering a side-effect-free preview, unchanged-file deletion, timestamp and length changes, locked files, invalid timestamps and the real cleanup entry script with a mocked clipboard. The operation runner also tests differently capitalized dependency names. The Windows PowerShell 5.1 component suites total 128 passing checks. PowerShell 7 reported an antivirus block in the replacement cleanup catalog; that new suite is not validated in that engine. No security exclusions or bypasses were added. Changed-file detection uses size and modification time; it does not detect identical metadata or eliminate the filesystem race between checking and deleting a file.
+Unreleased audit, 2026-09-26: seven cleanup regressions pass in Windows PowerShell 5.1, covering a side-effect-free preview, unchanged-file deletion, timestamp and length changes, locked files, invalid timestamps and the real cleanup entry script with a mocked clipboard. The file tests use the production allowlist and plans containing only disposable files. The operation runner also tests differently capitalized dependency names. Fourteen packet-capture checks pass in both engines, covering path boundaries, file ancestors, argument preservation, native-command failures, absent exit codes and previews through the real entry script. The Windows PowerShell 5.1 component suites total 142 passing checks.
+
+PowerShell 7 still reports `ScriptContainedMaliciousContent` in production `Get-WindBrowserCacheCatalog` enumeration and `Invoke-WindCleanup` target validation. The block reproduced after removing the original private-function test replacement, so the earlier test-mock-only diagnosis was incomplete. Both Defender and Bitdefender are registered on the host; available Defender events did not identify the source. No security exclusions or bypasses were added. This remains a release blocker. Changed-file detection uses size and modification time; it does not detect identical metadata or eliminate the filesystem race between checking and deleting a file. Capture path checks likewise do not eliminate concurrent filesystem replacement; the global Pktmon session still requires live ownership/interruption testing.
 
 All 48 feature tests also pass in PowerShell 7. The previous v0.0.5 Gitea job ended as `Canceled after 0s`; it provides no remote test evidence. The local validation results above remain distinct from server CI status.
 
+Cleanup now enumerates browser profiles only when BrowserCache is selected. Packet-monitor invocation was also checked against the real `pktmon help` command; this is a read-only native-command smoke test, not evidence of successful live capture or conversion.
+
 Release-candidate update, 2026-09-24: 120 tests pass in each of Windows PowerShell 5.1 and PowerShell 7 (25 policy/transaction, 29 app/menu, 19 offline-bundle, 47 feature/package/security/service/account/preset/operation-runner). The policy tests include current-user registry scope, Home direct-control selection and managed-edition exclusion, and Enterprise-only selection. The app tests include aggressive all-removable-app and explicit Store selection, safe skipping of ambiguous desktop registrations, protection of security/dependency applications, completeness of FreshInstall/Medium/Strong/Maximum and the non-destructive EstablishedSafe preset, the reported JSON catalog failure and journal callback scope failure, browser-before-removal sequencing, installer errors, stale inventory, partial failure, bundle deduplication, group selection, keyboard navigation, filtering and terminal layout limits. Feature tests cover real populated and empty operation-runner reports, captured GUI child-script invocation and deferred atomic JSON writers across nested module boundaries, cleanup report finalization, invoker path-traversal refusal, fresh/established/unknown install-age decisions, continued execution of independent groups after a failure, dependency skipping, preset schema refusal, shared Recall apply/skip/conflict decisions, atomic JSON replacement, malformed or duplicate policy/service/account/network catalogs, protected update-endpoint refusal, untrusted registry-hive refusal, network journal recovery, cleanup-root and protected-log refusal, recovery-journal exclusion, browser-cache scope, protected-service exclusion, service disable/restore, forged service-plan rejection, exact account-package reset, credential allowlisting, report redaction, VeraCrypt volume validation, versioned secret-free security audit behavior and AME manifest structure. Native arrow/Space/Enter/Esc browser selection was also exercised in a real Windows PowerShell console. Live host inventory, service planning and account planning were read-only. No real uninstall, account purge, policy or service write, reboot, firewall change, capture, device disable, Recall deletion or update installation was performed.
 
 The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. `Build-Executable.ps1` must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded `requireAdministrator` manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.