first commit

docs/ADDITIONAL-CHANNELS.md

@@ -0,0 +1,24 @@
+# Additional Windows privacy channels and tool findings
+
+Reviewed 19 September 2026. These additions concern documented features and investigation leads. They are not discoveries of previously undisclosed surveillance mechanisms.
+
+## Beyond the GDID screenshot
+
+Keep the original complaint's attribution and the two research repositories' confidence levels distinct. The source review and workbook already track those claims. Additional controls should be justified by the function producing a connection, rather than by treating every Microsoft destination as equivalent.
+
+- **Connectivity probes:** NCSI sends connectivity tests and influences applications' view of network availability. Disabling it can create false offline status and application problems. A private probe endpoint is a possible managed-network option, not a universal anonymity feature. Treat this as optional and verify the exact edition/build. [NCSI overview](https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview).
+- **Certificate trust:** trusted and disallowed certificate information is security maintenance. Fully offline designs need a separate refresh path. Clearing certificates or turning off validation would undermine the protection we want to retain. [Microsoft trust-list guidance](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates).
+- **Windows Error Reporting:** fault reports are distinct from an application's own telemetry. Reducing optional diagnostics does not configure every third-party reporter. Use vendor-specific controls and keep bounded local diagnostics useful for repair. [WER overview](https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting).
+- **Activation, Store licensing and update eligibility:** treat these as separate dependencies. Offline update selection must not assume that a package is licensed or applicable merely because its filename contains the right Windows version. Do not implement activation bypasses.
+- **Names on local networks:** hostname discovery, LLMNR/mDNS, NetBIOS and sharing warrant a separate local-network inventory. This is a planned investigation, not a claim that all those channels reach Microsoft. Avoid breaking printers or local discovery blindly.
+- **Cached credentials and tokens:** identity-provider state is not an ordinary disposable temp cache. Deleting it can affect login, licensing and recovery. The proposed retention module excludes credentials and identity stores; the GDID script review explains why deleting a CDP cache does not prove remote deletion.
+
+## Additional GitHub comparisons
+
+| Project | Finding | Decision |
+| --- | --- | --- |
+| [LeDragoX/Win-Debloat-Tools](https://github.com/LeDragoX/Win-Debloat-Tools) | Archived 3 October 2025; README scopes its last supported builds and warns that removal may not be easily reversed | Historical reference; exclude from current deployment |
+| [HotCakeX/Harden-Windows-Security](https://github.com/HotCakeX/Harden-Windows-Security) | Security hardening and App Control resources; recommendations include connected Microsoft services | Review individual security controls to preserve protections. Do not adopt its entire recommendation set as a privacy profile |
+| [DavidXanatos/wumgr](https://github.com/DavidXanatos/wumgr) | Windows update-management project described for Windows 10 | Management UI is not an anonymity boundary. Current Windows 11/ESU applicability and update behavior need testing before selection |
+
+Together with the previous register, these make 19 tool/research entries. None of these projects was executed. The best-fit design remains a small supported-policy layer, optional dependency-aware app removal, measured network enforcement, and a distinct offline-maintenance option for users who need no direct Microsoft contact.

docs/GDID-SCRIPT-REVIEW.md

@@ -0,0 +1,50 @@
+# GDID research and supplied-script review
+
+Reviewed 19 September 2026. **Do not incorporate the supplied script unchanged.** It proposes meaningful feature restrictions, but neither its implementation nor the cited research establishes a complete identifier block. No supplied script or repository code was executed on the host.
+
+## Reviewed material
+
+- [gdid-reversal, pinned revision dd4dd5d](https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md).
+- [We-running-GDID-back, pinned revision b4daa44](https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md).
+- User-supplied `Pasted text.txt`, SHA-256 `0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13`. Line references below refer to that exact attachment. The repositories are research writeups; the pasted script was reviewed separately and its authorship was not inferred.
+
+## What the additional research changes
+
+The sequel reports multiple context-specific device PUIDs, Widgets emitting a SYSTEM-context identifier, and a Store request using the SQMClient MachineID. These are the author's observations, not independently reproduced results from this project. They justify expanding the investigation beyond CDP. [Pinned sequel](https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md).
+
+The author's first writeup corrects its earlier local-account assumption. Its description of CDP as a consumer of an identity value also makes cache deletion a poor basis for a reset claim. [Pinned original](https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md).
+
+Our assessment: a loaded DLL, token-scope entry or function name alone does not prove a particular request executed, identify the exact code path that supplied a value, or establish the backend's retention and reconciliation rules. A client-side ETW trace can expose an HTTPS URL before encryption; that does not mean an ordinary network observer receives the URL in cleartext. Reinstall changing a value does not logically exclude hardware as one of several provisioning inputs. These distinctions must survive into the blog.
+
+## Problems in the pasted script
+
+| Finding | Evidence in attachment | Consequence and required correction |
+| --- | --- | --- |
+| Status looks for the wrong marker | Markers at lines 24–25 use `GDID-BLOCKER`; line 120 searches `GDID-BLOCK START` | A block written by the script is reported absent. Compare exact marker constants and check the entries themselves. |
+| Success can be printed after failure | `Continue` at line 19; native `sc.exe` calls at 49–64; unconditional success at 132 and 138 | Native exit codes are not checked. Fail on errors, wait for service state, read back configuration and report partial results. |
+| Activity policies are not restored | Values overwritten at 68; removed at 72; no prior-value journal | Existing policy, including an existing deny, can be lost. Record existence, registry type and original value before writing. Refuse externally changed values on rollback. |
+| Per-user service template is not correctly inventoried | `Get-Service CDPUserSvc` at 44; suffixed instances stopped at 49 | The template and generated instances need separate handling. Microsoft documents the template in the registry. Verify persistence across sign-out/sign-in and reboot. |
+| Service recovery loses state | Only `StartType` recorded; fallback `demand`; unconditional start at 64 | Delayed-start metadata and previous running state are not preserved. Do not guess defaults or start a previously stopped service. |
+| Hosts file is rewritten without a transaction | Lines 76–97 | A one-time backup is created but not used by enable. Preserve original bytes/encoding, validate balanced unique markers, use atomic replacement and detect concurrent edits. Do not restore an old whole-file backup over newer user edits. |
+| Malformed markers can remove unrelated entries | The loop at 79–84 and 90–95 stays inside until an end marker | A missing end marker discards the remainder. Reject malformed input before writing anything. |
+| ASCII conversion changes existing content | Lines 86 and 96 | Non-ASCII comments are changed; existing encoding is not preserved. This is independently reproducible in memory. |
+| Cache removal is irreversible and has ambiguous user scope | Lines 100–105 use the elevated process's `LOCALAPPDATA` | Elevation with a different administrator account targets that account's profile. No cache backup exists; regeneration is not restoration. Make deletion a separate explicit operation with resolved path and reparse-point checks. |
+| Hosts entries are not a complete egress boundary | Domain list at 30–38 | Exact names do not cover all subdomains, cached destinations, direct IP or resolver bypass. Neither marker presence nor DNS cache flushing verifies traffic suppression. |
+| Notification blocking has collateral effects | WNS/notify names in the domain list | WNS supports app notifications and management scenarios. Keep it out of the default denylist pending measured need and compatibility tests. |
+| No real read-only status entry point | Elevation and directory creation happen before mode dispatch | Status should not request administrator rights or create state. Separate audit from mutation and handle elevation cancellation explicitly. |
+
+Microsoft's [per-user services documentation](https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows) describes templates and generated instances. Its [Windows endpoint documentation](https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints) describes WNS functionality and the consequences of blocking it. Neither page proves that disabling those components suppresses every device identifier.
+
+## Verification performed
+
+PowerShell parsed the attachment without executing it. Three isolated in-memory probes confirmed: the real marker fails the script's search pattern; an unmatched start marker drops trailing synthetic entries; ASCII conversion changes a synthetic Unicode comment. No service, policy, hosts file, cache or network setting was modified. Results are in `reports/upstream-review/pasted-script-static-probes.json`.
+
+## Integration decision
+
+1. Keep the current supported-policy engine as the default. Add an experimental CDP investigation item, not a button labelled “GDID disabled.” Prefer a documented policy deployment route when available.
+2. Separate CDP restrictions, Activity History retention, Widgets, notification delivery and Store behavior. Each needs its own applicability, side effects, evidence and restoration record.
+3. Exclude cache deletion from “disable.” If offered, show irreversible data loss and identify the exact user profile before deletion.
+4. Keep Windows Update, Store security updates/revocation, Defender, reputation protection and certificate maintenance in the acceptance tests. Do not disable `wlidsvc`, `WpnService` or all Microsoft domains simply to make an identifier disappear from one trace.
+5. Reproduce claims in disposable Windows 11 and eligible Windows 10 environments. Record OS build, app versions and account mode. Observe CDP and Widgets separately, then repeat after one change at a time and after reboot/sign-in.
+6. Capture only what the lab needs. Raw ETW/HTTP details may include tokens, query strings, account names and device IDs. Use disposable accounts; redact at source for reports and keep raw evidence access-restricted. Do not enumerate or publish identifiers from this development host.
+7. Publish a matrix of observed effects and residual connections. “No event seen in this workload” is a bounded observation, not proof of backend unlinkability.

docs/HOME-GUIDE.md

@@ -0,0 +1,45 @@
+# Windows Home and browser setup guide
+
+These are manual controls, not a claim that the prototype has applied them. Open Windows Settings and use the pages below. Labels vary by Windows build. Keep this guide open while configuring; the tool does not automatically open pages, install applications or alter this host.
+
+| Page / URI | Recommended choice | Verify |
+| --- | --- | --- |
+| Privacy & security > Diagnostics & feedback (`ms-settings:privacy-feedback`) | Optional diagnostic data off; tailored/personalized offers off where available | Required data can remain on Home; read the descriptions |
+| Privacy & security > General (`ms-settings:privacy-general`) | Advertising ID and suggested content off | Recheck per-user settings |
+| Privacy & security > Location (`ms-settings:privacy-location`) | Location services off | Check representative apps; IP geolocation remains possible |
+| Privacy & security > Camera (`ms-settings:privacy-webcam`) | Camera access off unless needed | Test packaged and desktop apps and Windows Hello |
+| Privacy & security > Microphone (`ms-settings:privacy-microphone`) | Microphone access off unless needed | Test conferencing and browser recording; hardware switch for stronger restriction |
+| Privacy & security > Speech (`ms-settings:privacy-speech`) | Online speech recognition off | Recheck dictation needs |
+| System > Clipboard (`ms-settings:clipboard`) | Cross-device sync off; history off for Strict | Clear existing history separately if wanted |
+| Privacy & security > Find my device (`ms-settings:findmydevice`) | Off if cloud location recovery is unwanted | Accept losing that recovery feature |
+| Privacy & security > Search permissions (`ms-settings:search-permissions`) | Microsoft/work-account cloud search off | This is not proof that all Start web search is disabled |
+| System > Storage (`ms-settings:storagesense`) | Configure Temp cleanup; leave Downloads deletion off | Review recycle-bin retention; not secure erasure |
+| Windows Update (`ms-settings:windowsupdate`) | Updates on; use supported temporary pause and active hours | Resume on the chosen date; keep browsers and antivirus updated |
+| Apps > Installed apps (`ms-settings:appsfeatures`) | Review Copilot, OneDrive and unwanted apps individually | Make OneDrive documents local/backed up first; preserve app dependencies |
+
+Also review Windows backup/settings sync, Phone Link, Widgets, online account use, notifications on the lock screen, browser location permissions and installed OEM utilities. A local Windows account reduces account coupling but is not an anonymity guarantee. Do not disable encryption or antivirus for performance/privacy presets.
+
+On eligible devices, Recall settings are under Privacy & security > Recall & snapshots. Review deletion effects before disabling by policy or removing the feature. Existing snapshot data is not backed up by Wind.
+
+## Browser choices
+
+- **Tor Browser:** official build, standard protections, no profile import, no extra extensions. Use it for sessions that need separation from your everyday identity. Personal logins still identify you to their providers. Tor Browser does not route other Windows applications through Tor.
+- **Zen:** everyday browser; review sync, search suggestions, site permissions, history/cookie retention and external connections. Keep updates enabled. Choose whether you want persistent account sessions.
+- **Helium:** everyday Chromium-based option; review setup network choices, update behavior and optional crash reporting. Keep security updates. Its local history/profile and logged-in accounts still need separate retention decisions.
+
+Install only the selected browsers; none becomes the default automatically:
+
+```powershell
+./Install-Apps.ps1 -App Tor,Zen,Helium -WhatIf
+./Install-Apps.ps1 -App Tor,Zen,Helium
+```
+
+WinGet contacts its community source and publisher download infrastructure and can produce local logs. WinGet and publisher installers have their own diagnostic/privacy settings; this installer wrapper does not override them. These installation connections are separate from Wind's offline policy engine. Verify displayed package identity/version/publisher before accepting installer prompts. WinGet manifests are community-maintained; their presence is not a security audit.
+
+## Mullvad and storage
+
+Mullvad installation is optional: `./Install-Apps.ps1 -App Mullvad`. It needs an account with service time; this tool does not purchase, log in or capture account numbers. After setup, review launch at startup, auto-connect, Lockdown mode, local-network access and split tunneling. Test disconnect/reconnect and DNS/IPv6 behavior. Do not assume a VPN stops Windows telemetry; it can carry that traffic too.
+
+VeraCrypt installation is optional: `./Install-Apps.ps1 -App VeraCrypt`. Configure containers and unmount behavior within VeraCrypt. Keep system encryption and recovery keys; do not decrypt the OS as a prerequisite. Win+L does not wipe all RAM or revoke every session token.
+
+The source-backed rationale and limitations are in [RESEARCH.md](RESEARCH.md). All recommendations need practical verification on the actual Windows build and hardware.

docs/OFFLINE-UPDATES.md

@@ -0,0 +1,55 @@
+# Updates without direct Microsoft contact from the protected PC
+
+Reviewed 19 September 2026. The implemented component is a local inventory and bundle-integrity verifier. The isolation boundary, offline scan and package installation workflow below still require lab validation. No update package was downloaded or installed on the development host.
+
+## Choose the actual boundary
+
+| Mode | Protected PC sends to Microsoft? | Maintenance | What changes |
+| --- | --- | --- | --- |
+| Reduced collection with online security | Yes, for retained services | Normal Windows, AV and app updates | Supported privacy settings and measured optional-feature restrictions |
+| Selective egress with update exceptions | Yes, on allowed update/security paths | Online updates if all dependencies work | Narrow feature/app rules; explicit residual traffic and compatibility tests |
+| Isolated Windows with a separate collector | No direct Internet traffic while isolation holds | Signed packages transferred from another machine | Local antivirus remains useful; online reputation and cloud protection are unavailable |
+
+Downloading directly over HTTPS requires outbound requests and protocol traffic. An inbound allow rule cannot supply an update that the client never requested. A firewall's direction describes who initiates a connection, not whether its payload is an upload or download. A proxy or VPN changes the intermediary; it does not inherently remove identifiers from application requests.
+
+For the strongest option, keep the protected Windows environment disconnected from the Internet, ideally at a separate enforcement boundary: no attached network adapter in a Windows VM, or physically disconnected networking on a separate PC. A gateway with no WAN forwarding can support an isolated local network, but its configuration must be tested. Do not call a hostname denylist an air gap. If browsing is needed, use a separate connected environment; copying files back introduces its own inspection requirements.
+
+The collector is a separate trust domain. It contacts Microsoft and other publishers and exposes its own network metadata. It fetches generic published files rather than forwarding the protected PC's live update requests, credentials, cookies or tokens. This is not a promise that Microsoft receives no requests anywhere.
+
+## Package workflow
+
+1. **Inventory locally.** `./Offline-Updates.ps1 -Json` reports only OS build, revision, edition and architecture. It makes no network requests. Select the correct product and architecture; Windows 10 needs independently verified support/ESU eligibility. Matching a build number is not proof of eligibility.
+2. **Select packages on the collector.** Review the official KB and Microsoft Update Catalog entry, prerequisites, architecture, known issues and reboot instructions. Windows 11 24H2 and later can require earlier checkpoint cumulative updates. Keep a recorded order rather than guessing from filenames. [Checkpoint update documentation](https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates).
+3. **Authenticate on the collector.** Use publisher downloads and supported signature/catalog validation for that package format, with current certificate/revocation information. An arbitrary hash supplied next to a file is not proof of authenticity. Record the exact source, version/KB, collection date and SHA-256 after authenticating the file. Do not assume `Get-AuthenticodeSignature` handles every MSU/CAB package like a signed EXE. The Windows servicing stack must still perform its normal package validation.
+4. **Prepare the transfer manifest.** Copy `config/offline-bundle.example.json` into a directory with the selected packages and replace every placeholder. Record declared prerequisites as earlier package IDs. The example deliberately fails verification until populated; it is not a list of current updates.
+5. **Transfer a minimal bundle.** Copy packages and manifest through controlled removable media. A one-way workflow reduces opportunities to carry identifying reports back out. Reject unknown executables and inspect transferred content. USB storage alone is not a hardware data diode.
+6. **Verify on the isolated PC.** Run `./Offline-Updates.ps1 -Mode Verify -Manifest 'D:\Updates\bundle.json' -Json`. The verifier rejects remote paths, reparse-point paths, path traversal, missing files, hash mismatches, target mismatch, duplicates and invalid declared prerequisite order. It never downloads, installs, changes services or evaluates manifest commands. Its local file access may still be observed by existing security software; process behavior does not isolate the entire OS.
+7. **Install through the supported package mechanism.** Follow the selected KB's instructions and retain Windows signature checking. Recheck files immediately before execution and keep the bundle protected from modification. The current helper intentionally does not execute packages. A verified hash result is not an installation instruction or a complete patch report.
+8. **Reboot, rescan and check security.** Confirm resulting build/KB and protection versions, check failures and pending reboot, and repeat functional tests. Keep servicing logs locally with bounded retention. Do not delete `WinSxS`, `SoftwareDistribution` or installer caches as a privacy cleanup shortcut.
+
+Microsoft supports a Windows Update Agent scan using the signed `Wsusscn2.cab` without querying Windows Update. The CAB contains security-update metadata, not update binaries or complete third-party coverage. The proposed scanner will use a temporary scan service, explicit offline search, cleanup and an externally enforced isolation boundary. It is not implemented in this release. [WUA offline scan](https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline), [Online property](https://learn.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-put_online).
+
+## Security maintenance beyond Windows cumulative updates
+
+| Component | Offline maintenance requirement | Residual cost / verification |
+| --- | --- | --- |
+| Windows and .NET | Correct cumulative/security packages and prerequisites | Check KB/build, reboot and applicability; update tooling must remain intact |
+| Defender | Current security intelligence, engine and platform packages through supported distribution | Cloud analysis and online first-seen reputation do not become offline features. Check all three versions, not only signature date. [Defender update channels](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates) |
+| Certificate trust | Planned trusted/disallowed certificate-list maintenance | Offline trust information can become stale; do not disable certificate validation to make installations pass. [Trust-list maintenance](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates) |
+| Tor, Zen, Helium and other apps | Official signed installers/updates and dependencies | Browser vulnerability fixes have their own cadence. Store-only dependencies may complicate fully offline maintenance |
+| Firmware, drivers, Secure Boot and recovery environment | Vendor-supported offline methods and separate tracking | A current OS build alone does not establish coverage of these components |
+| Offline scanner metadata | Fresh signed scan catalog and recorded retrieval date | A zero-result scan is limited to that catalog and scan scope |
+
+Decide an operational maintenance cadence and an emergency-update process before deployment. A scheduled package download on a collector is possible later; no recurring automation has been created. A stale offline machine can be less secure than an online machine with minimized diagnostics.
+
+## Egress implementation rules
+
+- Keep the current host online while developing. Validate containment on a disposable VM first, using an external gateway view and local process attribution. Do not test by dropping this host's connections.
+- Avoid indiscriminate Microsoft/Azure address blocking: shared services and changing endpoints create overblocking and gaps. A third-party website can use Microsoft-hosted infrastructure without being an OS telemetry destination.
+- For a Windows outbound-default-block profile, inventory existing allow rules first. Do not combine an explicit blanket block with supposed exceptions: explicit blocks take precedence. Cover every profile, interface, IPv4/IPv6 and TCP/UDP path. [Firewall precedence](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules).
+- Do not assume a download-only proxy filters identifiers. A later update-cache design must serve pre-fetched content and have no transparent upstream fallback. Its own requests and logs need a separate policy.
+- Measure boot, sign-in, idle, update checks, browsers, reconnect and sleep/wake. Record rejected and successful flows, and test recovery locally. Do not use domain ownership alone as evidence of purpose.
+
+## Delivered verification
+
+`Offline-Updates.ps1` and `src/Wind.OfflineUpdates.psm1` implement local inventory and integrity verification. Nineteen tests passed in PowerShell 7 and Windows PowerShell 5.1 using synthetic package bytes. The real host inventory was read successfully. No real update applicability, publisher authenticity, installation, offline WUA scan or containment test has passed yet; those remain explicit tasks.

docs/PLAN.md

@@ -0,0 +1,68 @@
+# Implementation plan and decision record
+
+## Product scope
+
+Build a Windows privacy wizard with three browser choices: Tor Browser, Zen and Helium. Its job is to reduce collection and retention, expose tradeoffs, and verify specific settings. It must never present a percentage-anonymous score or claim that a host is untraceable.
+
+The running Windows installation is the development host. Development and read-only inspection are authorized; this iteration creates the tool and planning artifacts without destructive OS changes or installation of applications on that host.
+
+## Profiles
+
+| Profile | Default behavior | Availability |
+| --- | --- | --- |
+| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, no cloud speech/clipboard sync/Find My Device/cloud search, DO without peering; updates unchanged | Prototype implements policy configuration on reviewed Pro/Enterprise/Education build families |
+| Strict | Standard plus no clipboard history and DO mode 99 | Prototype implements those added policies; advanced networking is not included yet |
+| Isolated session | Separate Tails environment; explicit persistence and identity separation | Guidance; not an automated OS installer |
+
+Users can select individual supported IDs with `-Id`. The future UI needs a clear restore action for each restriction so camera/microphone use is possible when wanted. Software permission controls and hardware disconnection must have distinct labels.
+
+## Work packages
+
+| Area | Delivered now | Next implementation and acceptance gate |
+| --- | --- | --- |
+| Policy engine | Audit, Plan, Apply, Restore, edition/build gates, readback, recovery journal and transaction tests | VM verification on each supported build/edition; confirm policy consumption after reboot |
+| Browser/app selection | Exact package IDs, optional interactive installer, no default takeover, `-WhatIf` | Verify freshness/publisher manifests in release pipeline; UI choices; detect updates without importing personal profiles |
+| Home edition | Read-only report and explicit manual guide | Supported Settings integration; verify actual toggles rather than pretending Pro policies work |
+| Diagnostics | Supported minimum Windows policy | Separate crash reporting, feedback and app-level controls with sources and side effects |
+| Connected experiences | A small documented subset | Backup/account sync, Phone Link/CDP, Widgets, Start web search, consumer suggestions, application-specific policies; validate edition and deployment mechanism |
+| Network controls | Research and validation specification only | Lab capture, destination attribution, narrow rules, timed recovery and VPN coexistence tests |
+| AI removal | Research and deletion warning | Inventory Recall eligibility and installed Copilot apps; explicit data-deletion preview; dependency-aware uninstall |
+| Debloat | Design only | Exact allowlist of removable apps; distinguish user/provisioned scope; OneDrive data-preservation preflight; Edge/WebView2 separation |
+| Updates | Keep, Automatic, Notify, Manual registry choices on eligible editions | Reboot and actual update workflow tests; UI temporary pause uses supported Windows mechanisms; browser/AV updates independent |
+| Sensors | Location/camera policy and limited app microphone policy | Optional hardware-device disablement with reliable recovery and device selection; never disable audio input blindly |
+| Cleanup | Home guide | Storage Sense integration with explicit retention and exclusions; skip busy files; never clean the registry or clear security logs |
+| Lock behavior | Design only | Session-lock trigger, vault integrations, clipboard handling, selected VeraCrypt volumes, busy-volume/error reporting; no generic process kill |
+| Encryption | Guidance only | Read-only encryption status without recovery-key capture; key-custody guide; no automatic encryption/decryption migration |
+| Security software | Preserve existing protections | Optional Bitdefender selection after conflict checks; no automatic Zillya recommendation pending sufficient evidence |
+| Packaging | Local CLI scripts | Signed release, reproducible manifest, checksums, native GUI; optional AME wrapper after VM validation |
+
+## Network design requirements
+
+The requested no-direct-Microsoft-contact option now has a [separate collector and offline-maintenance design](OFFLINE-UPDATES.md). Local inventory and bundle-integrity verification are implemented; isolation, signed-package authentication, offline scan and installation are not deployed. A connected profile with update exceptions necessarily retains some outbound Microsoft traffic. The fully isolated profile loses online cloud security capabilities and needs explicit maintenance for all security components.
+
+- Normal mode retains security maintenance, licensing and requested connected functions. Fewer observed connections is a measurable result, not proof of anonymity.
+- Strict egress must be opt-in and recoverable. Before applying rules, export the exact relevant state, maintain local console recovery, schedule a short rollback, and cancel it only after connectivity checks pass. The recovery service must not depend on the network being tested.
+- Account for all firewall profiles, existing explicit allows, IPv4/IPv6, TCP/UDP/QUIC, DNS and application DoH, physical/VPN adapters, sleep/wake and boot-time behavior.
+- Do not install a TLS interception root certificate to inspect traffic. Encrypted captures establish destination/timing observations; do not claim their payloads have been audited.
+- Never claim VPN Lockdown prevents Microsoft collection inside the tunnel. If the requirement is absolutely no Microsoft-bound traffic, document the compatibility loss and use a separately enforced/offline environment rather than a hidden default.
+- Network captures are opt-in, local and short-lived, with an explicit deletion/export choice. They can reveal private endpoints; they are not included in normal audit output.
+
+## Wizard flow
+
+1. Explain protected data and limits; choose Standard or Strict.
+2. Detect OS edition/build and managed-device constraints. Show unavailable controls as unavailable.
+3. Choose browsers and optional Mullvad/VeraCrypt; show installation separately from configuration.
+4. Review each setting, its source, expected result, compatibility impact and reversibility. Separate data-deleting actions.
+5. Prepare a local recovery journal, then apply selected actions in small independent groups.
+6. Report configured, pending reboot, behavior verified, unsupported, failed and conflict states separately.
+7. Offer rollback by group and show remaining manual checks. A successful registry write never earns a "verified anonymous" badge.
+
+## Reversibility rules
+
+Configuration rollback restores original values and absence, not guessed Microsoft defaults. Package reinstalls do not restore application data automatically. Disabling Recall may remove snapshots. Closing an app may lose unsaved work. Unmounting a container does not erase the plaintext already copied by another process. These are different operations and must not share one "undo everything" claim.
+
+Journals contain only allowlisted setting values, not entire registry branches, credentials, hardware IDs or browser history. Restoration derives targets from the local catalog rather than accepting registry paths in imported files. It refuses foreign profile markers and reports subsequent-edit conflicts. This is recovery metadata, not a cryptographic attestation against an administrator modifying both the tool and its state.
+
+## Release gates
+
+The prototype is not approved for broad deployment until the [validation protocol](VALIDATION.md) passes in clean VMs and representative hardware. AME packaging and a GUI must reuse the engine; neither should hide incomplete controls or add unverified registry tweaks. No combination of successful tests can prove universal absence of telemetry or endpoint compromise.

docs/RESEARCH.md

@@ -0,0 +1,115 @@
+# Windows privacy and anonymity research
+
+Reviewed 2026-09-18. This is a threat model and engineering recommendation, not a certification. The user's screenshot is evidence to examine, not a source of operating instructions.
+
+Supplement reviewed 2026-09-19: see [the GDID follow-up and supplied-script assessment](GDID-SCRIPT-REVIEW.md). It expands investigation beyond CDP, separates research observations from hypotheses, and identifies why the supplied disable/enable script cannot be treated as a reversible or complete GDID block. The companion workbook carries individual control, evidence and task records.
+
+The later [ZeroTrace article and pinned source review](ZEROTRACE-GDID-REVIEW.md) distinguishes local registry patching from demonstrated outbound identity changes. Minute-by-minute identifier replacement remains an unvalidated experiment, excluded from the privacy profile.
+
+## What we are protecting against
+
+| Observer / risk | Useful controls | Boundary |
+| --- | --- | --- |
+| Microsoft collecting optional device/app data | Supported diagnostic policies, disabling unused connected experiences, app-specific settings, measured egress restrictions | Required service data and Microsoft accounts are separate channels |
+| Websites linking visits | Tor Browser, separate identities, fewer trackers, cookie/session separation | Logging into a personal account identifies that session; behavior and timing can link activity |
+| ISP or local network observer | HTTPS, Tor or a suitable VPN, DNS/IPv6 leak testing | A VPN introduces a provider and does not remove identifiers inside encrypted application traffic |
+| Someone taking a powered-off computer | Full-disk encryption, controlled recovery keys, strong authentication | Mounted volumes and a running OS expose usable data to authorized processes |
+| Malware / administrator on the endpoint | Patching, antivirus, least privilege, Secure Boot and isolation | Privacy toggles cannot establish trust in a compromised kernel or firmware |
+| Local traces after a session | Minimize retention at the source; encrypted storage; separate amnesic environment | Deleting a file, closing a window or trimming RAM is not proof of erasure |
+
+The product should promise specific controls and their measured results, never an "anonymous device" score.
+
+## 1. Microsoft connections: treat the channels separately
+
+Microsoft distinguishes optional/required Windows diagnostics from **required service data** for connected experiences and essential services. Updates, certificates, authentication, licensing, Defender and cloud functions do not all follow one telemetry switch. Disabling optional diagnostics is a worthwhile reduction, not a total network block. Some essential connections are security dependencies. [Essential services](https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences).
+
+Use documented policies and validate them by edition. Pro's supported diagnostic minimum differs from Enterprise/Education. A tool writing `AllowTelemetry=0` on every edition can mislead its user. The current engine uses 1 on Pro and 0 on Enterprise/Education, and declines policy mutation on Home. Windows policies do not configure all third-party applications. [Diagnostic configuration](https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization), [System policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry).
+
+Engineering decisions:
+
+- Maintain separate controls for diagnostics, crash submissions, advertising, cloud speech, clipboard sync, Windows Search cloud sources, OneDrive, account sync, Widgets, Microsoft Store and each installed application.
+- Keep Windows security protections active in the normal profile. Show any cloud-protection/sample-submission tradeoff individually; do not disable antivirus to chase fewer connections.
+- Keep local security event logs. Limit this toolkit's own records to settings and recovery state; no analytics, identifiers, browsing history or crash uploads.
+- Do not promise deletion of information Microsoft or another service already received. Account dashboards and provider retention policies are a separate concern.
+
+## 2. Device identifiers and the screenshot
+
+The DOJ complaint's paragraphs 25-29 describe records associating a Windows installation identifier with visits, times and IP addresses. It attributes a description of GDID to a Microsoft representative, including persistence across updates and a new identifier on reinstall. It does not fully document the collection mechanism or establish universal monitoring of every URL. [Primary complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=).
+
+Microsoft's UCDOStatus schema documents `GlobalDeviceId` in Delivery Optimization reporting. That field establishes an identifier's existence, not that this reporting table captures every browsing action. Windows' advertising ID, `MachineGuid`, Microsoft account identifiers, GDID, hardware serials and browser fingerprints must not be treated as interchangeable. [UCDOStatus schema](https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus).
+
+Do not ship a "GDID reset" or "HWID anonymizer." Random registry edits are not proof of unlinkability and can impair licensing or applications. A new installation can still be linked through accounts, network use and behavior. Local accounts reduce account coupling but are not evidence that a device has no Microsoft-issued identifiers. Avoid collecting these IDs in audit reports at all.
+
+Connected Devices Platform deserves testing separately from diagnostic services. Microsoft's documented `AllowConnectedDevices` CSP can disable CDP and requires reboot, but this research did not establish a supported direct registry mapping. Therefore the prototype does not invent one. [Connectivity policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-connectivity#allowconnecteddevices).
+
+## 3. Network enforcement
+
+Recommended progression:
+
+1. Disable unnecessary features using supported controls.
+2. Observe connections in a clean VM during defined workflows.
+3. Categorize destinations by purpose: optional diagnostics, cloud functionality, security maintenance, licensing and unknown.
+4. Add narrow, versioned restrictions and repeat both privacy and compatibility tests.
+5. Offer an isolated/offline environment for requirements that cannot tolerate Windows' connected behavior.
+
+A hosts file or DNS denylist alone is not a complete enforcement boundary: it only affects traffic using that resolution path, cannot distinguish shared-host services, and does not establish coverage for direct IP traffic or alternative resolvers. Lists must include provenance, review date, reason and rollback. Never blanket-block Azure, Microsoft CDNs or all of `svchost.exe`.
+
+For a future strict egress profile, use default outbound blocking plus explicit necessary allowances, rather than an explicit "block everything" rule with supposed exceptions. Windows gives explicit block rules precedence over conflicting allow rules. Review pre-existing allow rules, profiles and interface changes; coexistence with VPN filtering needs tests. [Firewall rule precedence](https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules).
+
+Where policy support allows it, DO mode 0 disables peering; mode 99 also avoids the DO cloud service. Updates still require their own connections. Mode 100 is deprecated on Windows 11. None of these choices warrants a "GDID disabled" label. [Delivery Optimization modes](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode).
+
+Mullvad's app has a kill switch and a separate Lockdown option. Setup must distinguish installed, authenticated, connected, auto-connect configured, and blocking when disconnected. Test DNS, IPv6, sleep/wake, tunnel failure and split-tunnel exceptions. A no-activity-logging VPN policy is not a claim that the Windows client has no diagnostic files. [App guide](https://mullvad.net/en/help/using-mullvad-vpn-app), [logging policy](https://mullvad.net/en/help/no-logging-data-policy).
+
+Do not automatically layer a VPN with Tor as a universal improvement. Tor's project advises against this for users without the knowledge to configure the combination safely. [Tor and VPNs](https://support.torproject.org/tor-browser/general/vpn-with-tor/).
+
+## 4. Three browsers, distinct uses
+
+| Choice | Default intent | Setup requirement |
+| --- | --- | --- |
+| Tor Browser | Sessions where unlinkability matters | Official package; stock protections; no imported personal profile or added extensions; separate identifying account activity |
+| Zen | Everyday Firefox-based browsing | Review telemetry/external connections, sync and permissions; keep security updates; choose cookie/history retention |
+| Helium | Everyday Chromium-based browsing | Review its setup's network choices, updates, extension services and optional crash reporting; keep security updates |
+
+Tor Browser protects its own configured traffic, not all Windows traffic. Do not substitute Tor proxy settings in Zen/Helium for Tor Browser's complete protections. Do not randomize user agents or install fingerprinting add-ons into Tor Browser by default. [Tor best practices](https://support.torproject.org/tor-browser/security/using-tb-safely/), [other browsers](https://support.torproject.org/tor-browser/security/using-tor-with-other-browsers/).
+
+Zen states that it removes telemetry but acknowledges external service requests and the possibility of missed Firefox telemetry. Browser updates and sync are separate from ordinary browsing storage. Verify the selected release rather than converting its marketing claim into a guarantee. [Zen privacy policy](https://zen-browser.app/privacy-policy/).
+
+Helium's policy says requests arise from user actions or enabled/configured features. It describes optional crash reports that can contain fragments of memory, limited service logging, and Cloudflare delivery for updates. This is compatible with a privacy-oriented browser, but not "never connects anywhere." The official Windows release checked was 0.17.1.1, published 2026-09-16; future installations resolve through WinGet and must be reviewed for freshness. [Helium privacy](https://helium.computer/privacy), [official releases](https://github.com/imputnet/helium-windows/releases).
+
+Separate browser choices do not automatically separate identities. The same email address, reused account, uploaded document metadata or copied tracking URL can reconnect sessions. Keep this explanation practical in the wizard. No automatic default-browser takeover or profile import.
+
+## 5. Sensors and physical presence
+
+Windows location off limits its location feature; applications can infer location through IP addresses and other mechanisms. The app should say "Windows location disabled," not "location untraceable." [Microsoft location privacy](https://support.microsoft.com/en-us/windows/privacy/windows-location-service-and-privacy).
+
+Camera and microphone permissions differ between packaged and desktop applications. The implemented microphone policy is a default for covered Windows apps; per-app exceptions and desktop access must be checked separately. Do not mark it as a hardware kill. Use the device-wide Settings switches, firmware controls where supported, or physical disconnection for stronger sensor control. Device Manager and software mute remain reversible by sufficiently privileged software. [Camera/microphone limitations](https://support.microsoft.com/en-us/windows/privacy/windows-camera-microphone-and-privacy), [app policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone).
+
+Optional camera policy can affect authentication or conferencing workflows, so test those explicitly. Disabling Bluetooth, Wi-Fi discovery or remote features is optional and must account for input devices and remote support. Prefer supported Wi-Fi MAC randomization where available; it concerns local network tracking, not an internet-wide identity reset. [Wi-Fi driver design](https://learn.microsoft.com/en-us/windows-hardware/drivers/network/wdi-miniport-driver-design-guide).
+
+## 6. Disk encryption, memory and Win+L
+
+Keep system encryption active. Review recovery-key custody separately from whether encryption is enabled. Offer VeraCrypt for containers/removable media; do not silently decrypt BitLocker to replace it. No keys, recovery passwords or volume names belong in tool logs.
+
+A lock-event feature should lock the password manager, clear clipboard data where possible and attempt graceful unmount of explicitly selected non-system encrypted volumes. Capture every session lock, not merely the keyboard shortcut. A busy-volume failure must be visible on unlock. Default to preserving work instead of killing arbitrary processes or forcing unmount.
+
+VeraCrypt erases non-system volume master keys on unmount, but an application can retain decrypted contents in memory. System encryption has different constraints. RAM encryption options are not a general RAM wipe; full shutdown is stronger than leaving the system running, but immediate erasure cannot be promised. [VeraCrypt memory documentation](https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html).
+
+"Logged keys" needs precise terminology: keystrokes, encryption keys, cached passwords and session tokens are different data. Win+L is not a countermeasure for an installed keylogger. No generic RAM cleaner or LSASS/process killer belongs in this product.
+
+## 7. Cleanup, AI and debloating
+
+Use retention controls first. Storage Sense can clean temporary files; Downloads and recycle-bin deletion need separate choices. It is maintenance, not certified sanitization. SSD behavior, copies, application databases, sync and backups prevent simple promises that a deleted item is unrecoverable. [Storage Sense](https://support.microsoft.com/en-us/windows/experience/storage-filemanagement/manage-drive-space-with-storage-sense).
+
+Recall is distinct from cloud Copilot and per-application AI features. Microsoft's `DisableAIDataAnalysis` and Recall removal policies can delete existing snapshots. Policy rollback cannot restore those snapshots. The first release intentionally documents this instead of placing the action in its reversible catalog. [Windows AI policies](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis).
+
+The debloat design uses an explicit app inventory and individual selections, distinguishes current-user removal from provisioning for future users, and preserves dependencies. Before OneDrive removal, verify local availability and backup of cloud-only documents and known-folder redirection. Keep Edge/WebView2 separate. Do not delete system directories or security components to claim lower telemetry.
+
+Exclude registry cleaners, blanket log clearing, SSD free-space wiping and RAM trimming. Working-set trimming is a memory-management operation, not secret erasure. [Working sets](https://learn.microsoft.com/en-us/windows/win32/memory/working-set).
+
+## 8. Choice of base tool / operating environment
+
+WinUtil provides useful UI, app installation and reversible settings, but every preset needs review and version pinning. Do not chain multiple debloat tools on a machine. This prototype uses its own small, documented policy catalog, not an unreviewed execution of WinUtil. [WinUtil tweak guidance](https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/tweaks.mdx).
+
+AME is a delivery mechanism. Its Privacy+ methodology describes removal of Windows Update, conflicting with the requirement for reversible update choices. A future Wind AME wrapper should invoke the same tested engine rather than duplicate settings or remove security services. [Privacy+ methodology](https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf).
+
+For sessions requiring an amnesic environment, prefer a separate Tails USB over promises about making ordinary Windows forget everything. Persistence must remain an explicit choice. Tails still cannot guarantee safety against malicious hardware or identifying user behavior. [How Tails works](https://tails.net/about/index.en.html).

docs/STATUS.md

@@ -0,0 +1,30 @@
+# Delivery status — 2026-09-18
+
+Update architecture supplement completed 2026-09-19: local OS inventory and offline bundle verification are implemented in `Offline-Updates.ps1` and `src/Wind.OfflineUpdates.psm1`. Nineteen new tests passed in PowerShell 7 and Windows PowerShell 5.1. Real host inventory returned only OS version/edition/architecture. No real package download, authenticity validation, applicability scan, installation or network isolation was performed. The register now contains 85 controls/decisions, 21 identifier/data-channel entries, 19 tool/research entries, 20 claims, 24 remaining tasks, 12 supplied-script findings and a separate update-maintenance sheet. See `docs/OFFLINE-UPDATES.md` and `docs/ADDITIONAL-CHANNELS.md`.
+
+A sourced blog draft and pinned-revision GDID research review are included. Workbook formulas were recalculated and tested with temporary status edits, then restored; rendered sheets and exported structure were inspected. No Excel desktop execution was performed.
+
+The supplied script was parsed without execution. Three isolated in-memory probes reproduced its marker mismatch, malformed-marker truncation and ASCII conversion defect. No new OS policy, service, hosts-file, cache, firewall or application mutation was performed. The added repositories remain research leads, not independently validated identifier suppression.
+
+## Delivered
+
+- Research and threat model with primary sources, implementation plan and release validation protocol.
+- Three browser choices: Tor Browser, Zen and Helium; optional Mullvad and VeraCrypt installers.
+- Local PowerShell policy engine: read-only audit, plan, explicit apply, recovery journal and conflict-aware restore.
+- Home edition manual guide; no unsupported policy enforcement claims.
+
+## Verification performed
+
+- 23 transaction/recovery tests passed in PowerShell 7.6.5.
+- The same 23 tests passed in Windows PowerShell 5.1.
+- Real journal create/atomic-replace/parse test passed using workspace files.
+- All PowerShell source files parsed successfully during verification.
+- Real read-only audit on this Windows Home (`Core`) build 26200 reported all 10 Standard profile controls as unsupported for automatic policy enforcement.
+- Installer previews used `-WhatIf`; no package installation occurred.
+- Live operating-system policy mutation, app uninstallation, firewall changes and telemetry suppression were not performed or claimed.
+
+Compatibility testing found and corrected PowerShell 5.1 array enumeration differences and null-path behavior in journal replacement. Mock registry tests do not prove operating-system enforcement, privacy guarantees or absence of network traffic.
+
+## Remaining release work
+
+The full wizard is not complete. VM policy behavior tests, physical sensor checks, measured network enforcement, GUI/AME packaging, data-preserving debloating, cleanup automation and lock-event integration are still pending as detailed in [PLAN.md](PLAN.md). No broad deployment or anonymity certification is implied by the prototype.

docs/VALIDATION.md

@@ -0,0 +1,52 @@
+# Validation and privacy acceptance protocol
+
+## Completed checks
+
+The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.
+
+The transaction test suite uses an in-memory registry adapter, never production policy writes. It covers edition gates, diagnostic choices, unsupported builds, update modes, microphone exceptions, original value types, read failures, exact restoration, reapply, journal failures, mid-apply failures, writes that fail after mutation, restore conflicts, interrupted operations, repeated restore, untrusted journal entries, installation mismatch and stale plans.
+
+Run `./tests/Run-Tests.ps1` with both PowerShell 7 and Windows PowerShell 5.1. Parse all `.ps1` / `.psm1` files with the PowerShell parser. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.
+
+## VM matrix required before release
+
+| OS | Test |
+| --- | --- |
+| Windows 11 Home 24H2/25H2 | Audit reports unsupported machine policies; Apply makes no changes; manual guide matches current Settings |
+| Windows 11 Pro 24H2/25H2 | Standard/Strict apply, readback, reboot, behavioral checks and restore |
+| Windows 11 Enterprise/Education 24H2/25H2 | Same, including actual diagnostic policy effect |
+| Unknown/future build | No automatic mutation until separately reviewed |
+| Domain/MDM managed device | Apply/Restore decline; no competing policies |
+| Non-admin / 32-bit process | Read-only operations work where possible; real mutation declines |
+
+Use snapshot-backed clean VMs, then repeat relevant tests on physical hardware. A VM does not validate real microphones, cameras, TPM behavior or physical network adapters. Never use production credentials in the test matrix.
+
+## Behavior checks
+
+After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Confirm update scan/download/install and Defender updates still work in the normal profile.
+
+Restore original registry types/values and absence; compare with the preflight snapshot. Keep externally changed settings intact and report conflicts. Test interruption before the first write, between writes, during journal replacement and during restore. Test a filled/read-only journal filesystem, registry permission denial and competing changes.
+
+`Configured` means the catalogued value matches. Only behavioral verification can show the intended feature effect. Policy precedence, MDM, user policy and Windows changes may produce different effective behavior.
+
+## Network checks
+
+Use an external lab gateway capture plus a local process-attribution view when needed. Keep the capture start time, build, chosen controls, workflow and duration. Avoid personal accounts; keep raw captures local. No TLS interception is required or installed.
+
+Compare baseline and configured runs across boot/login, 15 minutes idle, browser launch, start search, deliberate update check, app installation, account sign-in, reboot and restore. Repeat with and without VPN. Classify observed destinations; distinguish optional diagnostics from security maintenance and user-requested cloud features.
+
+For VPN/strict-egress testing, include IPv4, IPv6, DNS, application DoH, TCP, UDP/QUIC, network changes, sleep/wake, connection loss, app exit, tunnel reconnect and split-tunnel exceptions. Verify recovery without network access. Do not accept a single IP-check website as a complete leak test.
+
+Document: "During these workflows, on this build, over this interval, the following traffic was observed/blocked." Do not conclude that an encrypted payload contains no identifier or that an unobserved connection can never occur later.
+
+## Package and browser checks
+
+Verify exact WinGet package ID, publisher download domain, installer version/hash and available architecture against each official project release. Preserve hash verification. Report nonzero installation exits and reboot requirements. An installer finishing does not establish account login, VPN connection, browser permissions or encryption configuration.
+
+Tor must remain on official update channels with stock fingerprinting protections. Zen and Helium need a current browser-security update check, visible sync/crash/permission decisions and tests that default-browser/profile import remain user-controlled.
+
+## Data deletion and lock checks for future modules
+
+Require a separate preview for Recall snapshot removal, app data deletion and cleanup. Exclude Downloads/documents by default. Skip locked files, junctions and filesystem reparse points. Never recursively follow arbitrary paths in a cleanup tool.
+
+For lock handling, exercise Win+L, automatic screen lock, user switching and remote-session disconnection. Busy VeraCrypt volumes, unsaved files and unavailable vault APIs must produce explicit failures. Verify clipboard history/sync separately from the current clipboard. Never report a complete RAM wipe.

docs/ZEROTRACE-GDID-REVIEW.md

@@ -0,0 +1,16 @@
+# ZeroTrace GDID source review
+
+Reviewed 2026-09-19. Static source review only; no upstream program executed, local identifiers collected, registry changed or network enforcement applied. The workbook's existing implementation counts are unchanged.
+
+## Evidence and limits
+
+- **Registry patch, demonstrated by source:** `write_lid` writes HKCU's LID and `main` reads it back. No request capture, delayed persistence check, certificate validation or remote unlinkability test appears in this program. [Pinned patcher source, commit 2c9bceacbdd20a814b5c800a7a23a3706996664c](https://github.com/5mukx/GDID-Extractor/blob/2c9bceacbdd20a814b5c800a7a23a3706996664c/patch-poc/src/main.rs).
+- **Local enumeration, demonstrated by source:** the Rust extractor reads registry, firmware, disk, adapter and TPM public-key information. Its printed hardware report does not demonstrate that these fields were transmitted in a Windows identity request. [Pinned extractor source](https://github.com/5mukx/GDID-Extractor/blob/2c9bceacbdd20a814b5c800a7a23a3706996664c/rust/src/main.rs).
+- **Article assertions needing reproduction:** automatic LID restoration; universal hardware relinking; GDID on every Microsoft request. The certificate-import discussion uses tentative language before presenting a definite outcome. Treat these as unresolved, not established backend behavior. [ZeroTrace article](https://www.zerotracelab.com/blog/gdid-windows-tracking).
+- **Case evidence:** paragraphs 25-30 describe a persistent installation identifier, URL records and corroborating account/IP evidence. They do not identify Edge or a specific collection mechanism. The complaint describes a new GDID after reinstall; that does not establish whether other signals can link installations. [DOJ complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=).
+
+## Project decision
+
+Minute-by-minute LID replacement remains an unvalidated experiment, excluded from the privacy profile. A changed registry value is not our success criterion. Independent research would need versioned, repeatable observations of actual outbound identifiers before and after a change, including reboot and service restart, plus security/update compatibility checks. Even changed outbound identifiers would not prove the provider cannot correlate sessions.
+
+Prioritize measurable reductions in unnecessary data transmission. Keep credential stores, TPM state and security protections intact while evaluating supported controls. No claim that blocking one identity endpoint eliminates all Microsoft collection is justified by this review.

docs/build-privacy-register.mjs

@@ -0,0 +1,432 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Workbook, SpreadsheetFile, FileBlob } from '@oai/artifact-tool';
+
+const root = path.resolve(import.meta.dirname, '..');
+const out = path.join(root, 'outputs', '01a0b6c2-22ad-7b62-9a5a-4a09014a9b42');
+await fs.mkdir(out, {recursive:true});
+const reviewed = new Date('2026-09-18T12:00:00Z');
+const resumed = new Date('2026-09-19T12:00:00Z');
+const S = {
+ diagnostics:'https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization',
+ events:'https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-24h2',
+ optional:'https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data',
+ services:'https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences',
+ endpoints:'https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints',
+ cdp:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-connectivity#allowconnecteddevices',
+ gdid:'https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus',
+ reversal:'https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md',
+ sequel:'https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md',
+ case:'https://www.justice.gov/usao-ndil/media/1450651/dl?inline=',
+ defender:'https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission',
+ smart:'https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-smartscreen',
+ edge:'https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/urldiagnosticdataenabled',
+ recall:'https://learn.microsoft.com/en-us/windows/client-management/manage-recall',
+ ai:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis',
+ activity:'https://support.microsoft.com/en-us/windows/privacy/windows-activity-history-and-your-privacy',
+ search:'https://support.microsoft.com/en-us/windows/privacy/windows-search-and-privacy',
+ sensors:'https://support.microsoft.com/en-us/windows/privacy/windows-camera-microphone-and-privacy',
+ location:'https://support.microsoft.com/en-us/windows/privacy/windows-location-service-and-privacy',
+ storage:'https://support.microsoft.com/en-us/windows/experience/storage-filemanagement/manage-drive-space-with-storage-sense',
+ ram:'https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html',
+ working:'https://learn.microsoft.com/en-us/windows/win32/memory/working-set',
+ firewall:'https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules',
+ updates:'https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings',
+ life:'https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025',
+ tor:'https://support.torproject.org/tor-browser/security/using-tb-safely/',
+ vpnTor:'https://support.torproject.org/tor-browser/general/vpn-with-tor/',
+ zen:'https://zen-browser.app/privacy-policy/',
+ helium:'https://helium.computer/privacy',
+ mullvad:'https://mullvad.net/en/help/using-mullvad-vpn-app',
+ mullvadLogs:'https://mullvad.net/en/help/no-logging-data-policy',
+ tails:'https://tails.net/about/index.en.html',
+ appprivacy:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy',
+ winutil:'https://github.com/ChrisTitusTech/winutil',
+ winutilSupport:'https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/getting-started.mdx',
+ debloat:'https://github.com/Raphire/Win11Debloat/wiki/Features',
+ privacy:'https://github.com/undergroundwires/privacy.sexy',
+ sophia:'https://github.com/farag2/Sophia-Script-for-Windows',
+ sophiapp:'https://github.com/Sophia-Community/SophiApp',
+ xd:'https://github.com/builtbybel/xd-AntiSpy',
+ simple:'https://github.com/henrypp/simplewall',
+ spy:'https://github.com/crazy-max/WindowsSpyBlocker',
+ legacy:'https://github.com/W4RH4WK/Debloat-Windows-10',
+ sycnex:'https://github.com/Sycnex/Windows10Debloater',
+ bleach:'https://github.com/bleachbit/bleachbit',
+ port:'https://github.com/safing/portmaster',
+ portfaq:'https://docs.safing.io/portmaster/faq',
+ atlas:'https://github.com/Atlas-OS/Atlas',
+ ame:'https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf',
+ local:'Local project: docs/STATUS.md; config/policies.json; tests/Run-Tests.ps1',
+ design:'Project engineering decision; not a verified Windows guarantee'
+};
+
+// Separate software delivery from host application and observed effectiveness.
+const policies = JSON.parse(await fs.readFile(path.join(root,'config/policies.json'),'utf8'));
+const controls = policies.map(p => [p.Id, p.Title, 'Windows policy', p.Standard !== null ? 'Default' : p.Strict !== null ? 'Strict' : 'Optional', 'Implemented', 'Not applied', 'Pending',
+ p.Impact, `HKLM\\${p.Path}\\${p.Name}. Standard=${p.Standard ?? 'unchanged'}; Strict=${p.Strict ?? 'unchanged'}${p.EnterpriseValue !== null ? '; Enterprise/Education='+p.EnterpriseValue : ''}.`,
+ 'Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.',
+ 'Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.', '', p.Source, reviewed]);
+function c(id,name,area,choice,stage,action,limit,test,source='design') {
+ controls.push([id,name,area,choice,stage,'Not applied','Pending',action,limit,'Edition/build and installed-feature checks required unless stated otherwise.',test,'',S[source]??source,reviewed]);
+}
+c('tailored','Personalized offers and diagnostic personalization','Diagnostics','Default','Planned','Turn off personalized offers based on diagnostics.','Separate from diagnostic collection; names and availability vary by build.','Verify Settings and effective policy after reboot.','diagnostics');
+c('feedback','Feedback prompts','Diagnostics','Optional','Planned','Suppress unsolicited feedback requests.','Does not disable diagnostic transport.','Check supported setting on each edition.','diagnostics');
+c('crash-upload','Optional crash and error submissions','Diagnostics','Default','Planned','Reduce optional diagnostic crash uploads; review Windows Error Reporting separately.','Dumps may contain user content. Preserve useful local troubleshooting and security records.','Test app crash handling and retention without uploading real user documents.','optional');
+c('edge-url','Edge optional URL diagnostics','Browser','Default','Planned','If Edge remains, disable optional URL/per-page diagnostics using its policy.','This is separate from SmartScreen, browsing sync and Windows diagnostics.','Check edge://policy and a lab traffic baseline; keep browser updates.','edge');
+c('recall','Recall snapshot retention','AI','Default','Planned','Detect eligibility; turn off snapshot saving with supported controls.','Some Recall policies delete existing snapshots. Present deletion separately; rollback cannot recover them.','Test eligible hardware/VM where supported; confirm setting and storage outcome.','ai');
+c('recall-export','Recall export and Click to Do','AI','Default','Research','Review export settings and Click to Do separately from Recall saving.','Feature, region and edition restrictions apply. Click to Do policy does not control its Recall integration.','Inventory availability and verify each supported control.','recall');
+c('copilot','Copilot and application AI features','AI','Optional','Planned','Offer per-app removal and cloud-AI settings for unused features.','One Copilot toggle does not cover Office, Edge, search, Recall and third-party AI.','Inventory exact packages; preserve shared runtimes; test reinstall.','debloat');
+c('cdp','Connected Devices Platform','Connected features','Optional','Research','Evaluate documented AllowConnectedDevices deployment; reboot required.','No invented registry mapping. Suppressing CDP has not been shown here to eliminate GDID.','Test supported CSP/management route and cross-device breakage in a VM.','cdp');
+c('phone-link','Phone Link and cross-device experiences','Connected features','Optional','Planned','Unlink and uninstall unused Phone Link features through supported interfaces.','Account-side records and other devices remain separate.','Test phone integration removal and restoration.','services');
+c('windows-backup','Windows Backup and settings sync','Connected features','Optional','Planned','Disable unwanted account backup and sync after reviewing recovery needs.','Do not silently delete recovery keys or existing backups.','Verify local data availability and supported recovery path.','services');
+c('local-account','Local Windows account','Accounts','Optional','Planned','Offer a local account where supported; avoid unnecessary Microsoft sign-in.','A local account is not proof of no device identifier; app sign-ins remain independent.','Preserve account access and recovery before any migration.','design');
+c('cloud-records','Existing provider records','Accounts','Optional','Planned','Provide links to account privacy/export/deletion controls.','Local toggles cannot delete provider logs, retained records or other people\'s copies.','Document provider-specific deletion scope and retained categories.','services');
+c('activity-history','Local activity history','Retention','Optional','Planned','Stop local activity history and separately offer clear history.','Cloud upload option was deprecated on patched Windows 10/11 in January 2024. Avoid obsolete spying claims.','Check actual build and Settings; distinguish future retention from deletion.','activity');
+c('start-web','Start web search and suggestions','Connected features','Optional','Research','Review Start/Bing web queries independently from cloud-source search.','AllowCloudSearch alone does not establish that web queries stop.','Find supported edition-specific policy and test actual queries.','search');
+c('widgets','Widgets, weather and news','Connected features','Optional','Planned','Disable or remove unused Widgets through supported controls.','Changes functionality and may affect bundled app packages.','Test update/reinstall and taskbar behavior.','debloat');
+c('recommendations','Consumer suggestions and promotional content','Connected features','Default','Planned','Review Start suggestions, Settings offers and Spotlight content individually.','Different settings and edition support; no single total-advertising switch.','Check visible result plus policy after feature updates.','debloat');
+c('typing','Typing, inking and personal dictionary','Input','Optional','Research','Reduce online personalization and review local dictionary retention.','Local and cloud settings differ; existing cloud-speech policy covers only one route.','Check language/accessibility impact and supported controls.','appprivacy');
+c('app-permissions','Contacts, calendar, messages and account information','Permissions','Default','Planned','Review covered app permissions and deny unused access.','Packaged-app controls do not constrain every desktop program.','Test covered apps and exceptions; do not report hardware isolation.','appprivacy');
+c('sensor-hardware','Camera and microphone hardware control','Sensors','Optional','Planned','Offer device-wide settings, physical disconnect or hardware switches.','Software disablement is reversible by privileged software; some cameras support Windows Hello.','Test desktop apps, browsers, conferencing and authentication.','sensors');
+c('radio','Bluetooth, nearby sharing and Wi-Fi discovery','Network','Optional','Research','Disable unused discovery and review Wi-Fi MAC randomization support.','May disconnect input devices; MAC changes concern local networks, not global anonymity.','Inventory adapters; test reconnect and recovery without disabling active input.','design');
+c('remote','Remote access and file sharing','Network','Optional','Planned','Review unnecessary RDP, Remote Assistance and sharing exposure.','Managed devices and legitimate remote support need separate treatment.','Test reachability, account access and rollback in lab.','design');
+c('onedrive','OneDrive removal','Debloat','Optional','Planned','Offer unlink/uninstall after local-copy and folder-redirection preflight.','Cloud-only files must be downloaded or separately backed up first; removal does not delete cloud copies.','Open sampled files offline; verify backup and known-folder paths.','design');
+c('edge-removal','Edge removal','Debloat','Optional','Research','Use supported uninstall only where available; otherwise configure privacy.','Keep WebView2 separate. Do not force-delete servicing files to remove the browser.','Validate OS region/build, dependent apps and future security updates.','design');
+c('app-removal','Unused consumer and OEM applications','Debloat','Optional','Planned','Inventory and select exact packages; distinguish current-user and provisioned removal.','Keep dependencies, Store/update infrastructure and accessibility tools unless explicitly selected.','Preview removals; test reinstall and new-user provisioning.','design');
+c('third-party','OEM, GPU, game-launcher and application analytics','Third parties','Default','Research','Audit each installed app\'s analytics, sync, crash and advertising controls.','Windows settings do not govern all third parties; anti-cheat and drivers need individual review.','Record app/version/publisher and official setting; observe residual connections.','design');
+c('office','Office and productivity cloud experiences','Third parties','Optional','Research','Review diagnostics and optional connected experiences in each product.','Account sync, licensing and collaborative features have separate dependencies.','Use product-specific policy docs before implementation.','design');
+c('storage-sense','Temporary-file retention','Cleanup','Default','Planned','Use Storage Sense with explicit retention; skip active files.','Exclude Downloads by default; recycle-bin deletion gets its own choice. This is housekeeping, not sanitization.','Preview candidates and exclusions; verify no deletion outside selected directories.','storage');
+c('browser-retention','Browser cookies, cache and history','Cleanup','Optional','Planned','Use browser-owned retention and clear-on-exit options.','Clearing cookies signs users out; downloaded files, sync and server records remain.','Test each browser; preserve passwords/bookmarks unless separately selected.','design');
+c('recent-files','Recent items, thumbnails and application MRUs','Cleanup','Optional','Research','Minimize retention and offer scoped, app-specific cleanup.','Deleting caches is irreversible and they can reappear. No sweeping registry cleanup.','Inventory selected cache schema and test with disposable data.','design');
+c('temp-script','Scoped temporary-folder cleanup fallback','Cleanup','Optional','Planned','If needed, build preview-first cleaner with age threshold and literal allowed roots.','Skip junctions/reparse points, locked files and active installer data; no recursive arbitrary paths.','Tests must prove no traversal outside approved directories.','design');
+c('registry-cleaner','Registry cleaner','Cleanup','Reject','Excluded','Do not include a general registry cleaner.','Unrelated registry deletion has no demonstrated identifier-blocking benefit here and can break software.','Use exact documented setting changes with a recovery journal.','design');
+c('no-logs','Blanket Windows log deletion','Retention','Reject','Excluded','Retain security, update and recovery logs; minimize toolkit data collection instead.','No-logs is not a credible OS-wide promise; disabling records harms diagnosis and incident response.','Ensure toolkit contains no analytics, browsing data, keys or identifiers.','design');
+c('ssd-wipe','Routine SSD free-space wiping','Cleanup','Reject','Excluded','Do not use as routine privacy cleanup.','Wear, remapped blocks, backups and prior copies defeat simple erasure claims.','Use appropriate device sanitization procedures only for a separate disposal task.','design');
+c('ram-cleaner','RAM trimming and generic memory cleaners','Memory','Reject','Excluded','Do not include as an anonymization feature.','Working-set reduction is not proof that sensitive memory was erased.','Use application lock/unmount and protected storage.','working');
+c('lock-actions','Actions on session lock','Memory','Optional','Planned','Lock password manager, clear clipboard and gracefully unmount selected non-system containers.','Win+L does not erase all keys, tokens or keystrokes. Do not kill LSASS or arbitrary apps.','Test every session-lock path, busy volumes, unsaved work and visible failure on unlock.','ram');
+c('sleep-shutdown','Sleep, hibernation and shutdown choices','Memory','Optional','Research','Explain that a locked running OS can retain secrets; offer an intentional full-shutdown workflow.','Shutdown is not a guarantee of instantaneous physical RAM erasure; hibernation uses storage.','Test Fast Startup/hibernation behavior and preserve encryption/recovery.','ram');
+c('disk-encryption','System disk encryption','Security','Keep','Planned','Keep or enable supported system encryption and review recovery-key custody.','Do not disable BitLocker/device encryption as a debloat tweak. Never collect recovery secrets in reports.','Verify encryption status and recovery access without logging keys.','design');
+c('veracrypt','VeraCrypt containers','Applications','Optional','Prepared','Optional interactive installer is ready; containers and lock integration remain manual.','Installed does not mean encrypted; mounted data and other apps can retain plaintext.','Verify package publisher; create/test disposable container and graceful unmount.','ram');
+c('tor-browser','Tor Browser','Applications','Optional','Prepared','Installer prepared; use stock protections for sessions requiring unlinkability.','Protects its configured browser traffic; personal logins identify a session.','Verify official release, connection and no profile import or added extensions.','tor');
+c('zen-browser','Zen','Applications','Optional','Prepared','Installer prepared for everyday Firefox-based browsing.','Privacy policy acknowledges external requests; settings and releases require review.','Test updates, permissions, sync choices and retention.','zen');
+c('helium-browser','Helium','Applications','Optional','Prepared','Installer prepared for everyday Chromium-based browsing.','Optional crash reports and configured services are separate privacy decisions.','Test updates, extension services, permissions and optional reporting.','helium');
+c('mullvad-vpn','Mullvad VPN','Applications','Optional','Prepared','Installer prepared; add funded account, auto-connect and chosen Lockdown behavior.','Installation is not connection. VPN changes network observer and egress IP, not application identifiers.','Test disconnect, DNS, IPv6, reboot, sleep/wake and split-tunnel exceptions.','mullvad');
+c('vpn-logs','VPN logging claims','Network','Keep','Research','Describe provider activity-logging policy separately from local app diagnostics.','A provider no-logging policy is not a no-logs Windows guarantee.','Review current policy and local support-bundle contents before sharing.','mullvadLogs');
+c('tor-vpn','Automatic VPN plus Tor stacking','Network','Reject','Excluded','Do not turn on this combination by default.','Tor warns against casual VPN combinations; threat model and configuration matter.','Offer separate documented workflows if a user needs the combination.','vpnTor');
+c('dns-blocking','DNS tracker blocking','Network','Optional','Planned','Use a reviewed resolver/filter with narrow lists and a clear logging policy.','Direct IP, alternate resolvers and shared domains limit coverage; DNS blocking is not all egress control.','Test false positives and IPv4/IPv6/DoH behavior; version lists and rollback.','design');
+c('egress','Application egress control','Network','Optional','Research','Evaluate one network enforcement tool in a VM; start from measured workflows.','Keep recovery access; do not stack competing WFP tools blindly.','Test VPN coexistence, update paths, reconnect, reboot and uninstallation.','simple');
+c('denylist','Microsoft endpoint denylist','Network','Optional','Research','Classify optional endpoints by feature, owner, purpose and capture evidence before blocking.','Do not block all Microsoft/Azure/CDN IPs or svchost.exe. Published lists are edition/version-specific.','Prove both reduced traffic and successful security workflows.','endpoints');
+c('outbound-default','Strict outbound default policy','Network','Optional','Research','For an advanced profile, use default-block with reviewed required allowances.','Explicit block rules override conflicting allows. Existing allows and all network profiles must be audited.','Disposable VM first; timed recovery and firewall-export rollback.','firewall');
+c('defender','Antivirus and cloud-delivered protection','Security','Keep','Planned','Keep active antivirus, tamper protection and cloud protection in the standard design.','Some security metadata leaves the device; this is an explicit retained security tradeoff.','Verify provider status, signatures and vendor-supported protection checks.','defender');
+c('sample-consent','Antivirus file sample submission','Security','Optional','Research','Expose supported submission choices with their security cost.','Turning samples off can impair block-at-first-sight; metadata can still be sent.','Test exact edition/product behavior. Never label samples-off as cloud-off.','defender');
+c('smartscreen','SmartScreen and reputation checks','Security','Keep','Planned','Keep reputation protection in the standard design.','Security URL checks differ from optional URL diagnostics and browser sync.','Use vendor demonstration checks, not live malware; test after network restrictions.','smart');
+c('trust','Certificate trust, revocation and time','Security','Keep','Planned','Preserve certificate trust/revocation, time sync, activation and servicing dependencies.','An endpoint may support essential security; broad domain blocking risks silent failures.','Verify TLS trust and OS servicing after restrictions.','services');
+c('patching','Security update workflow','Security','Keep','Planned','Default to current update behavior; optional notify/manual choice remains visible.','Manual has missed-patch risk. Do not remove servicing components or disable all update services.','Install actual cumulative update and AV/browser updates; reboot and rescan.','updates');
+c('windows10','Windows 10 coverage','Security','Keep','Research','Require supported edition or verified ESU enrollment before deployment.','Standard support ended 2025-10-14. Consumer page currently lists 2027-10-12; verify region/program at release.','Record exact SKU, coverage and installed security update. Windows 10 engine support is pending.','life');
+c('boot-hardening','Secure Boot, TPM, VBS and exploit mitigations','Security','Keep','Planned','Preserve supported hardware and OS security protections.','Do not trade them for a privacy or performance preset; firmware updates remain necessary.','Inventory status and compatibility before any optional change.','design');
+c('third-party-av','Bitdefender or Zillya','Security','Optional','Research','Do not replace working Defender automatically; evaluate a chosen product separately.','This project has not established a comparative privacy/security advantage or tested these vendors.','Review current privacy policy, independent protection tests, update support and uninstall behavior.','design');
+c('identifier-spoof','GDID, MachineGuid and hardware-ID spoofing','Identifiers','Reject','Excluded','Do not ship undocumented identifier edits or a universal ID reset.','Changing one value cannot prove unlinkability and may break licensing or apps.','Investigate mechanisms in a disposable lab without exporting actual personal identifiers.','design');
+c('tails','Separate amnesic environment','Isolation','Optional','Planned','Document Tails USB for a separate session with explicit persistence choice.','Does not protect against malicious hardware or voluntary identity disclosure.','Verify official image and usable hardware/network before relying on it.','tails');
+c('identity-habits','Accounts, posts and shared metadata','Behavior','Default','Planned','Reduce unnecessary disclosure; separate contexts and review document/photo metadata before publishing.','Reused accounts, shared content and personal details can reconnect sessions despite device settings.','Use a practical publishing checklist; never promise technical anonymity.','design');
+c('tool-retention','Toolkit data minimization','Toolkit','Default','Implemented','No analytics added; local settings journal supports restoration.','A recovery journal exists, so the tool is not literally log-free. Audit deliberately avoids GDID and recovery keys.','Review code and generated audit; document optional journal removal after recovery window.','local');
+
+const identifiers = [
+ ['GDID / GlobalDeviceId','Installation/device linkage','Microsoft reports and case records','Do not equate with advertising ID. No verified universal reset control here.','Investigate feature paths and effective network reductions in lab.','Documented field; collection path incomplete',S.gdid],
+ ['PCFP','Hardware-derived identifier','Windows 11 required diagnostic schema','Documented as an identifier calculated from hardware identifiers.','Use supported diagnostic minimum; do not assume reinstall removes hardware correlation.','Documented schema; emission not measured',S.events],
+ ['CensusId','Hardware identifier','Appraiser RunContext schema','Documented hardware identifier in compatibility-related events.','Preserve compatibility/update testing; no verified per-field suppression in this project.','Documented schema; emission not measured',S.events],
+ ['Advertising ID','Advertising personalization','Windows and participating applications','One specific advertising identifier; disabling it does not disable other IDs.','Implemented catalog control; not applied to host.','Official policy',policies.find(p=>p.Id==='advertising-id').Source],
+ ['Microsoft account / app accounts','Account identity','Signed-in services','Local Windows account does not sign every application out.','Minimize unnecessary sign-in and sync; preserve recovery access.','Architecture / design assessment',S.services],
+ ['MachineGuid / serials / TPM identity','Local and service-specific identifiers','OS, firmware and application-dependent','No evidence here that one registry edit removes all remote identification.','Avoid collecting them; no spoofing feature.','Scope limitation, not a measured traffic claim',S.design],
+ ['Public IP / timestamps','Network correlation','Destination services and network intermediaries','VPN changes visible egress but not IDs inside app traffic.','Mullvad configuration and leak tests; minimize account linkage.','Network design assessment',S.mullvad],
+ ['Wi-Fi MAC','Local radio/network identity','Nearby Wi-Fi infrastructure','Not normally the same identifier as a remote website sees.','Evaluate supported MAC randomization; retain network compatibility.','Design item; adapter testing pending',S.design],
+ ['Cookies / browser storage / fingerprint','Web session linkage','Websites and embedded third parties','Multiple browsers do not automatically separate identities.','Tor stock protections; appropriate retention and account separation.','Browser threat-model guidance',S.tor],
+ ['Optional browser URL diagnostics','Browsing data','Optional Microsoft browser diagnostics','Windows optional-data documentation includes Microsoft browser activity; not proof for every browser.','Disable optional collection; Edge URL policy separately.','Official documentation',S.optional],
+ ['Crash dumps','Potential memory contents','Diagnostic collection and local storage','Optional crash reports can contain portions of documents or pages.','Minimize uploads and retention without discarding all troubleshooting logs.','Official documentation',S.diagnostics],
+ ['Defender security metadata','File, process and network context','Cloud protection services','Metadata may still be sent with sample submission disabled.','Keep standard protection; explain data flow and optional tradeoff.','Official documentation',S.defender],
+ ['Recall snapshots','Local visual history / optional export','Eligible Recall installations','Distinct from Copilot chat; export and retention have separate controls.','Disable unused snapshot saving; preview irreversible deletion.','Official documentation',S.recall],
+ ['Activity history','Local activity record','Supported Windows feature','Patched Windows deprecated its cloud-upload option in January 2024.','Control local retention; avoid repeating outdated upload claims.','Official documentation',S.activity],
+ ['Third-party app identifiers','Product-specific telemetry','OEM utilities, browsers, launchers and apps','Requires app-specific evidence; no blanket Windows toggle.','Inventory publishers/settings and measure each application.','Research task',S.design]
+].map((r,i)=>[`I${String(i+1).padStart(2,'0')}`,...r.slice(0,6),'',r[6],reviewed]);
+
+const toolsData = [
+ ['Chris Titus WinUtil','Tweaks and app deployment','Current docs: Windows 11; Windows 10 unsupported','Useful UI and selective settings reference.','Inspect exact tweaks; exclude security/BitLocker reductions and blanket presets.','Candidate reference; not executed',S.winutil,S.winutilSupport],
+ ['Raphire Win11Debloat','Selective debloat and settings','Windows 10/11 project; exact build still needs testing','Per-app selection, previews and current feature catalog.','Exclude encryption-disabling choices; distinguish default restoration from original-state rollback.','Candidate for selected debloat; not executed','https://github.com/Raphire/Win11Debloat',S.debloat],
+ ['privacy.sexy','Generated privacy scripts','Windows catalog; validate each script/build','Source-linked scripts and individual selection help review.','Do not select all scripts. Review reversals and license before code reuse.','Reference library; not executed',S.privacy,S.privacy],
+ ['Sophia Script','PowerShell customization','Version-specific Windows 10/11 variants','Function-by-function design and corresponding default functions.','Default functions are not proof of restoring every original user value.','Selective reference; not executed',S.sophia,S.sophia],
+ ['SophiApp','Graphical tweak tool','Repository warns about deprecated 1.0.97','Related GUI project; inspect current supported replacement.','Do not deploy deprecated build based on a promised future version.','Legacy build excluded; recheck release',S.sophiapp,S.sophiapp],
+ ['xd-AntiSpy','Privacy/settings UI','Windows 11 focus; Windows 10 partial','Readable choices and plugin-based configuration.','Plugins expand trust surface; check exact changes and reversals.','Candidate for review; not executed',S.xd,S.xd],
+ ['simplewall','WFP application filtering','Windows 10/11 included','Useful per-app egress enforcement candidate.','Its filters can remain after uninstall unless removed/disabled. Test temporary filtering and recovery.','Lab candidate; not installed',S.simple,S.simple],
+ ['WindowsSpyBlocker','Traffic research and blocklists','Windows-oriented; current endpoint validation required','Traffic classification is useful input for lab analysis.','Treat lists as hypotheses, not permanent safe blocks. Separate update dependencies.','Research input; no rules imported',S.spy,'https://crazymax.dev/WindowsSpyBlocker/'],
+ ['Portmaster','Application firewall and DNS filtering','Windows/Linux; verify current installer compatibility','Alternative to simplewall for evaluation.','WFP/VPN coexistence and uninstall connectivity need testing. Avoid stacking both by default.','Alternative lab candidate; not installed',S.port,S.portfaq],
+ ['BleachBit','Local cleanup','Windows/Linux','Preview and app-specific cleaners can support optional retention work.','Deletion is irreversible; no secure-SSD or internet anonymity guarantee.','Optional cleanup candidate; not run',S.bleach,S.bleach],
+ ['W4RH4WK Debloat-Windows-10','Legacy debloat scripts','Archived 2025-09-23; deprecated','Historical examples only.','Not a maintained deployment choice for current Windows.','Excluded',S.legacy,S.legacy],
+ ['Sycnex Windows10Debloater','Legacy Windows 10 debloat','Windows 10 project; Windows 11 not established here','Historical app-removal patterns.','Do not infer current build support or exact-original restoration.','Excluded from current deployment',S.sycnex,S.sycnex],
+ ['Atlas','Windows modification playbook','Version-specific Windows deployment','Reviewable playbook architecture.','Broad OS changes exceed a small privacy profile; test each release rather than rely on old reputation.','Comparison only; not applied',S.atlas,S.atlas],
+ ['AME / Privacy+','Playbook delivery / privacy changes','Depends on playbook and target build','AME could eventually package the reviewed Wind engine.','Privacy+ methodology includes Windows Update removal, conflicting with this project\'s patching requirement.','Do not adopt Privacy+ wholesale',S.ame,S.ame],
+ ['gdid-reversal','Independent reverse-engineering research','Reported observations; not reproduced here','Suggests identity/CDP/Delivery Optimization investigation paths.','Not a validated anonymizer. Separate static findings, observations and hypotheses.','Research lead only',S.reversal,S.reversal]
+].map((r,i)=>[`T${String(i+1).padStart(2,'0')}`,...r.slice(0,6),'',...r.slice(6),reviewed]);
+
+// Case-derived text is deliberately short and attributed, not asserted as a universal OS property.
+const claims = [
+ ['Microsoft tracked Stokes through GDID','Supported as allegation','Complaint associates the identifier with attributed activity.','Affidavit paragraphs 25–29; this is not a conviction.',S.case],
+ ['Assigned per install; survives updates; changes on reinstall','Attributed description','The affidavit attributes this lifecycle to a Microsoft representative.','Paragraph 25. Do not infer reinstall guarantees unlinkability.',S.case],
+ ['Unique to physical device','Overstated','The description includes physical and virtual Windows installations.','Installation identity and immutable hardware identity differ.',S.case],
+ ['Ngrok, URLs, IPs and timestamps','Supported for this case','The complaint describes these associations.','Paragraphs 26–28 do not specify every collection component.',S.case],
+ ['It records every game played','Overstated','Growtopia login activity was correlated with Ubisoft records.','Paragraph 29 does not establish a complete installed-game history.',S.case],
+ ['Only documented in one obscure page','Unsupported absolute','GlobalDeviceId appears in published Microsoft reporting schemas.','Documentation of a field is not a complete explanation of collection.',S.gdid],
+ ['UCDOStatus proves universal web-history collection','Not established','UCDOStatus is a Delivery Optimization reporting schema.','A named field does not prove that this table records all URLs.',S.gdid],
+ ['Every browser on every Windows PC reports every URL','Not established','Neither cited source demonstrates this universal claim.','Do not present it as the blog\'s conclusion.',S.case],
+ ['Local account guarantees no Microsoft identifier','Not established','Independent research reports a path without Microsoft-account sign-in.','Useful lead; not independently reproduced by this project.',S.reversal],
+ ['GDID is the only persistent identifier worth checking','False simplification','Microsoft also documents PCFP and CensusId in required diagnostic schemas.','Documented fields do not prove emission on this host.',S.events],
+ ['Disabling advertising ID blocks GDID','Not established','The advertising-ID policy governs a different identifier.','Use exact scope labels and lab measurements.',policies.find(p=>p.Id==='advertising-id').Source],
+ ['No telemetry toggle means no Microsoft traffic','False simplification','Essential services and connected experiences have separate data flows.','Preserve agreed security dependencies and document residual traffic.',S.services],
+ ['Win+L erases all secrets from memory','Unsupported','Locking is not a general memory-erasure mechanism.','Plan app-specific locking and graceful unmount; do not claim total erasure.',S.ram],
+ ['Humans can identify themselves despite privacy tools','Design principle','Accounts, posts and shared content can reconnect contexts.','A practical privacy plan includes disclosure habits.',S.design]
+].map((r,i)=>[`C${String(i+1).padStart(2,'0')}`,...r.slice(0,4),'',r[4],reviewed]);
+
+const roadmap = [
+ ['P0','VM support matrix','Pro, Enterprise, Education and Home; reviewed Windows 11 builds; separate Windows 10 ESU track','Effective setting after reboot and update, not just registry readback.','Policy behavior','Open'],
+ ['P0','Security preservation baseline','Record antivirus, firewall, boot/encryption and update status without secrets','Cumulative update installs; AV signatures and browser updates succeed; protection checks pass.','Security','Open'],
+ ['P0','Network baseline','Disposable VM, documented workflows, Windows build, network path and capture duration','Compare before/after idle, reboot, browsing, sync and update traffic; no universal absence claim.','Network','Open'],
+ ['P0','Endpoint provenance register','Process/service attribution, hostname/IP, purpose, evidence, expiry and rollback','No unknown destination becomes a default block; validate DNS/IPv6/VPN behavior.','Network','Open'],
+ ['P0','Recoverability of networking','Local recovery access and exported firewall configuration','Timed recovery and uninstall restore connectivity; explicit block precedence tested.','Network','Open'],
+ ['P0','Original-state recovery engine','Existing mock and file journal tests; real Windows registry test in disposable VM','Crash/interruption, conflicting external changes and restoration verified.','Engine','Open'],
+ ['P1','Home Settings workflow','Current host is Core/Home build 26200','Guide accurately maps real Settings; no unsupported policy-enforcement labels.','Compatibility','Open'],
+ ['P1','Sensor verification','Camera/mic devices and covered vs desktop app permissions','Conferencing, browser access and Windows Hello tested; hardware state labelled separately.','Sensors','Open'],
+ ['P1','AI and debloat inventory','Package dependencies and Recall eligibility','Data-deletion preview, OneDrive offline-copy checks and reinstall path pass.','Apps','Open'],
+ ['P1','Retention implementation','Storage Sense first; browser/app-owned cleanup; scoped fallback only','Exclusions, age cutoff, reparse-point protection and active-file handling tested.','Cleanup','Open'],
+ ['P1','Lock-session integration','Password manager adapters and selected non-system volumes','Unsaved work protected; busy-volume failure reported; no system-process killing.','Memory','Open'],
+ ['P1','Identifier investigation','Documented fields plus independent GDID/CDP research','Reproducible lab notes; no claim of a suppression mechanism without measured evidence.','Research','Open'],
+ ['P1','Third-party application register','Installed publishers, versions, controls and official privacy sources','Each app has separate collection/update decisions; no silent global disablement.','Research','Open'],
+ ['P1','Pin upstream artifacts','Selected repository commit, release signature/hash and license review','No download-and-execute one-liners; reviewed local content only.','Supply chain','Open'],
+ ['P1','Browser and VPN acceptance','Tor, Zen, Helium, Mullvad selected individually','Update, publisher, profile separation and leak/Lockdown tests pass.','Applications','Open'],
+ ['P2','Graphical wizard / AME wrapper','Use same reviewed engine and recovery model','UI shows intended change, compatibility, deletion and restoration limits.','Delivery','Open'],
+ ['P2','Blog publication check','Re-read primary case and current product documentation','Claims retain attribution; screenshots and logs contain no private identifiers.','Editorial','Open'],
+ ['P2','Revalidation after Windows updates','Repeat on feature/security updates and changed app releases','Record build/version, deviations and regression outcomes before widening support.','Maintenance','Open']
+].map((r,i)=>[`R${String(i+1).padStart(2,'0')}`,...r,'Unassigned',null,'']);
+
+const delivered = [
+ ['D01','Policy catalog','Implemented',13,'config/policies.json','Includes two optional update entries; Standard selects 10, Strict 11.','Not applied'],
+ ['D02','Audit / plan / apply / restore engine','Implemented',1,'Wind.ps1; src/Wind.Core.psm1','Edition/build gates, journal and conflict-aware restoration.','Not applied'],
+ ['D03','Transaction and recovery tests','Passed',23,'tests/Run-Tests.ps1; docs/STATUS.md','Same suite passed in PowerShell 7.6.5 and Windows PowerShell 5.1. Mock registry plus file journal checks.','Not an OS enforcement test'],
+ ['D04','Host read-only audit','Completed',1,'reports/host-audit.json','Core/Home build 26200. Automatic policy enforcement declined. No private IDs collected.','Read only'],
+ ['D05','Interactive app choices','Prepared',5,'config/apps.json; Install-Apps.ps1','Tor, Zen, Helium, Mullvad, VeraCrypt. Installer previews only.','Not installed'],
+ ['D06','Research, Home guide and validation plan','Prepared',1,'docs/RESEARCH.md; docs/HOME-GUIDE.md; docs/VALIDATION.md','Implementation scope and known limits documented.','Documents only'],
+ ['D07','GitHub comparison and control workbook','Prepared',1,'Windows-privacy-register.xlsx','Sources reviewed 2026-09-18; repository execution and lab validation remain pending.','Documents only'],
+ ['D08','Blog draft','Prepared',1,'Windows-privacy-blog-draft.md','Evidence, motivation, privacy choices and honest completion status.','Not published']
+];
+
+// Resume additions retain previous evidence dates and identify newly reviewed material.
+for (const [id,name,action,limit,test,src] of [
+ ['cdp-experiment','Experimental CDP restrictions','Investigate CDP independently from other identity consumers.','Supplied script is not integration-ready; review records status and rollback defects.','Reproduce effects in disposable Windows environments; no host deployment.','sequel'],
+ ['wns-review','WNS notification blocking','Keep general WNS blocking out of the default design.','Notifications and management may be affected; a hosts entry is not a complete egress block.','Verify exact consumer and retained security functionality before any narrow restriction.','endpoints'],
+ ['store-id-review','Store identifier path','Investigate Store requests separately; preserve app security updates.','Do not block the entire Store or edit its identifier based on one report.','Lab observation with disposable accounts and redacted evidence.','sequel']
+]) { c(id,name,'Identifiers','Optional','Research',action,limit,test,src);controls.at(-1)[13]=resumed; }
+identifiers.push(
+ ['I16','Multiple device PUIDs','Context-specific identity','Independent follow-up research','Author reports several device PUIDs on one installation.','Extend lab scope beyond the interactive user.','Reported; not reproduced here','',S.sequel,resumed],
+ ['I17','Widgets identifier emission','Additional application path','Independent follow-up research','Author reports Widgets sending a SYSTEM-context identifier.','Test Widgets independently from CDP.','Reported; not reproduced here','',S.sequel,resumed],
+ ['I18','SQMClient MachineID / Store','Separate identifier family','Independent follow-up research','Author reports a matching Store request identifier.','Preserve Store updates; investigate separately.','Reported; not reproduced here','',S.sequel,resumed]
+);
+toolsData.push(['T16','We-running-GDID-back','Follow-up identifier research','Pinned b4daa443; Windows 11 observations','Expands the investigation beyond one CDP identifier.','Client symbols and token scopes alone do not prove backend reconciliation or every transmission.','Research lead only','',S.sequel,S.sequel,resumed]);
+claims[1][4]='Paragraph 25 attribution; follow-up research raises additional lifecycle/context questions.';
+claims.push(
+ ['C15','One identifier per installation is the complete model','Incomplete','Follow-up research reports multiple device PUIDs.','Treat as a lab hypothesis; retain court attribution separately.','',S.sequel,resumed],
+ ['C16','Disabling CDP proves all device IDs stopped','Not established','No test here establishes complete identifier suppression.','Test each emitting feature and retained service separately.','',S.sequel,resumed],
+ ['C17','An ETW HTTPS URL means cleartext on the wire','Incorrect inference','Local instrumentation can reveal data before transport encryption.','Differentiate local visibility, destination visibility and network-observer visibility.','',S.design,resumed]
+);
+roadmap.push(
+ ['R19','P0','Replace unsafe pasted-script patterns','See Script review findings and pinned source revisions','No integration until exact-state rollback, honest status and independent cleanup pass tests.','Engine','Open','Unassigned',null,''],
+ ['R20','P1','Reproduce follow-up identifier findings','Disposable accounts; context-specific identifiers; Widgets and Store independently','Record observed flows without raw IDs/tokens in reports; retain update/security acceptance tests.','Research','Open','Unassigned',null,'']
+);
+delivered.push(['D09','Pasted script and follow-up research','Reviewed',1,'docs/GDID-SCRIPT-REVIEW.md','Static review, parse check and three in-memory defect probes. No supplied script executed.','Read only']);
+const scriptReview = [
+ ['S01','High','False status result','24–25; 120','Writes GDID-BLOCKER but searches GDID-BLOCK.','Match constants exactly; verify entries and effective behavior.','Confirmed in-memory'],
+ ['S02','High','False success after partial failure','19; 49–64; 132; 138','Continues after errors and ignores native exit codes.','Check every result and effective service state; report partial failures.','Static finding'],
+ ['S03','High','Policy rollback destroys prior state','68; 72','Overwrites three values then deletes them on enable.','Journal original presence/type/value and detect conflicts.','Static finding'],
+ ['S04','High','Per-user service template handling','44; 49; 52','Template inventory differs from generated service instances.','Use documented template handling; test sign-in and reboot.','Official docs + static review'],
+ ['S05','Medium','Incomplete service restoration','44; 57–64','Does not preserve delayed-start metadata or running state.','Record exact state; do not guess Manual or always start.','Static finding'],
+ ['S06','High','Nontransactional hosts edits','76–97','Backup is not used by enable; whole file is rewritten.','Preserve bytes/encoding, journal, atomically replace and detect concurrent edits.','Static finding'],
+ ['S07','High','Malformed marker removes other entries','79–84; 90–95','Missing end marker drops every following line.','Reject unmatched or duplicate markers before mutation.','Confirmed in-memory'],
+ ['S08','Medium','ASCII conversion changes content','86; 96','Non-ASCII comments do not survive.','Preserve detected encoding and original bytes.','Confirmed in-memory'],
+ ['S09','High','Irreversible cache deletion / user scope','100–105','Targets elevated LOCALAPPDATA; enable cannot restore deleted data.','Separate explicit deletion; resolve intended profile and reject path escapes.','Static finding'],
+ ['S10','High','Hosts list overclaims suppression','30–38','Exact names do not prove all paths or identifiers are blocked.','Measured per-feature controls and residual-traffic reporting.','Design limitation'],
+ ['S11','Medium','Notification side effects','34–37','WNS is shared infrastructure, not a GDID-only endpoint.','Keep default notifications intact pending narrow tests.','Official endpoint docs'],
+ ['S12','Medium','Status elevates and creates state','11–27','Read-only mode enters the mutation setup path.','Audit without elevation or filesystem writes.','Static finding']
+].map(r=>[...r,'Not integrated','',r[0]==='S04'?'https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows':r[0]==='S11'?S.endpoints:'User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13',resumed]);
+
+const U={
+ checkpoint:'https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates',
+ scan:'https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline',
+ av:'https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates',
+ trust:'https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates',
+ ncsi:'https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview',
+ wer:'https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting',
+ local:'Local project: Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1; docs/OFFLINE-UPDATES.md'
+};
+for(const [id,name,area,choice,stage,action,limit,test,source]of[
+ ['offline-verifier','Offline bundle integrity verifier','Update architecture','Optional','Implemented','Verify local manifest, hashes, target build/architecture and declared dependency order.','Authenticity, applicability, coverage and containment remain unverified. No downloads or installation.','19 synthetic-package tests passed in PowerShell 7 and 5.1; real host inventory read.',U.local],
+ ['update-collector','Separate update collector','Update architecture','Optional','Planned','Download generic publisher packages on another machine for controlled transfer.','Collector still contacts publishers. Do not forward protected-PC requests or credentials.','Authenticate sources, packages and current revocation state; test transfer and supply chain.',U.checkpoint],
+ ['offline-scan','Offline Windows Update Agent scan','Update architecture','Optional','Planned','Use a fresh signed scan CAB and explicit offline search in an isolated lab.','Scan catalog is metadata, not update binaries or complete third-party coverage.','Verify temporary service cleanup, freshness, missing-update scope and external isolation.',U.scan],
+ ['isolation','No direct Internet from protected Windows','Update architecture','Optional','Research','Use a disconnected Windows environment and a separate maintenance/browsing environment.','Online cloud protection and reputation queries are unavailable. A denylist is not proof of isolation.','No attached VM NIC or physical disconnection; independent verification and local recovery.',S.design],
+ ['ncsi','Connectivity probes','Connected features','Optional','Research','Review NCSI; consider supported private probes on managed networks.','Turning off probes can affect perceived connectivity and applications.','Test captive portals, network changes and update behavior.',U.ncsi],
+ ['offline-trust','Offline certificate trust maintenance','Update architecture','Keep','Planned','Provide trusted/disallowed certificate-list maintenance for the isolated profile.','Never disable certificate validation; offline revocation knowledge can become stale.','Verify provenance, freshness and package trust after transfer.',U.trust],
+ ['patch-coverage','Whole-system patch coverage','Update architecture','Keep','Planned','Track Windows, .NET, Defender, browsers, firmware, drivers and recovery separately.','Current OS build or a zero-result scan does not establish full patch coverage.','Record actual installed versions, reboot outcomes and emergency-update process.',U.av],
+ ['local-discovery','Local-network identity disclosure','Local network','Optional','Research','Inventory hostname discovery, LLMNR/mDNS, NetBIOS and sharing.','These are not automatically Microsoft-bound flows; disabling discovery can break local devices.','Use disposable network captures and test printers/sharing before restrictions.',S.design],
+ ['credential-exclusion','Exclude credential stores from cleanup','Cleanup','Default','Planned','Keep identity caches, login tokens, recovery material and servicing stores out of generic cleanup.','Deleting a cache does not establish deletion of remote records and may break login or updates.','Verify exclusions and exact allowed roots before implementing cleanup.',S.design]
+]) {c(id,name,area,choice,stage,action,limit,test,source);controls.at(-1)[13]=resumed;}
+for(const [id,name,purpose,platform,use,limit,decision,url]of[
+ ['T17','Win-Debloat-Tools','Legacy debloat','Archived 2025-10-03; last documented builds limited','Historical reference.','Removal may not be easily reversed; not a current supported deployment base.','Excluded','https://github.com/LeDragoX/Win-Debloat-Tools'],
+ ['T18','Harden-Windows-Security','Security hardening','Current Windows security focus; exact app requirements need review','Individual security controls can inform preservation tests.','Connected-service recommendations are not our privacy profile; do not import all defaults.','Selective reference only','https://github.com/HotCakeX/Harden-Windows-Security'],
+ ['T19','wumgr','Update management','Project described for Windows 10','Update-management UI comparison.','Does not create a no-contact boundary. Current Windows 11/ESU behavior unvalidated.','Evaluation only','https://github.com/DavidXanatos/wumgr']
+])toolsData.push([id,name,purpose,platform,use,limit,decision,'',url,url,resumed]);
+identifiers.push(
+ ['I19','Connectivity probes','IP / timing at probe destination','Microsoft NCSI documentation','Connectivity detection is another independent network function.','Optional control with compatibility tests.','Documented; host traffic not captured','',U.ncsi,resumed],
+ ['I20','Update request metadata','Requests / network metadata','Online update architecture','Direct downloads need outbound protocol traffic.','Separate collector for no direct protected-PC contact.','Protocol constraint / design','',U.checkpoint,resumed],
+ ['I21','Windows Error Reporting','Fault reporting','Microsoft WER documentation','Separate from third-party application reporters.','Review reporting and local retention individually.','Documented; host traffic not captured','',U.wer,resumed]
+);
+claims.push(
+ ['C18','Download directly from Microsoft while sending it nothing','Not technically achievable','Requests and transport traffic are needed for a direct download.','Use a separate collector if the protected PC must not contact Microsoft.','',S.design,resumed],
+ ['C19','A proxy or VPN removes identifiers from update requests','Not established','Relaying a request does not necessarily alter its contents.','Only a reviewed design that serves pre-fetched content avoids forwarding those requests.','',S.design,resumed],
+ ['C20','Offline patches retain every online security capability','Incorrect','Online cloud analysis and reputation checks require connectivity.','Preserve local protections and explain the cloud-security tradeoff.','',S.defender,resumed]
+);
+roadmap.push(
+ ['R21','P0','Validate offline update end to end','Separate collector; authentic packages; isolated target; supported edition','Install known applicable updates and prerequisites; reboot and rescan; verify no target WAN access.','Updates','Open','Unassigned',null,''],
+ ['R22','P0','Implement offline WUA scanner','Signed current catalog, explicit offline search, temporary service registration','No online search or fallback; cleanup on failure; no full-coverage claim from empty results.','Updates','Open','Unassigned',null,''],
+ ['R23','P0','Offline security-maintenance coverage','Defender platform/engine/intelligence, trust lists, apps and firmware','Each required component has a tested source, freshness policy and installation evidence.','Security','Open','Unassigned',null,''],
+ ['R24','P1','Collector authenticity and transfer workflow','Publisher signatures and package catalogs; protect manifest and files','Hashes never stand in for publisher identity; reverify immediately before execution.','Supply chain','Open','Unassigned',null,'']
+);
+delivered.push(['D10','Offline bundle verifier and OS inventory','Implemented',1,'Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1','19 tests passed in PowerShell 7 and 5.1. No download, scan, installation or isolation applied.','Read only']);
+delivered[6][5]='Sources reviewed 2026-09-18/19; execution and lab validation remain pending.';
+const maintenance=[
+ ['U01','Windows cumulative / .NET','Normal supported online servicing','Reviewed Catalog packages and required checkpoints','Authenticity, applicability, order, installed KB/build and reboot','Workflow prepared','',U.checkpoint,resumed],
+ ['U02','Defender intelligence / engine / platform','Keep normal cloud and update services','Supported offline package distribution for all three components','Versions and freshness; cloud capability explicitly unavailable','Workflow prepared','',U.av,resumed],
+ ['U03','Trusted / disallowed certificates','Retain trust-list and revocation maintenance','Plan authenticated local trust-list refresh','Current provenance and revocation limitations; validation remains enabled','Research','',U.trust,resumed],
+ ['U04','Tor / Zen / Helium / apps','Keep publisher security update channels','Transfer authenticated installers and dependencies','Versions, signatures and browser launch/security behavior','Research','',S.design,resumed],
+ ['U05','Firmware / drivers / Secure Boot / WinRE','Retain vendor and OS maintenance','Separate vendor-supported offline methods','Per-component coverage; OS build alone is insufficient','Research','',S.design,resumed],
+ ['U06','Offline scan metadata','Online scan remains available','Fresh signed Wsusscn2.cab with offline WUA search','Catalog date, limited scope, temporary registration cleanup','Scanner planned','',U.scan,resumed],
+ ['U07','Bundle integrity','Local verifier available','Same verifier; no network calls or installers invoked','19 synthetic tests; hashes do not establish publisher authenticity','Implemented','',U.local,resumed],
+ ['U08','Isolation boundary','Online traffic intentionally permitted','Disconnected protected Windows; separate connected collector','External verification; online cloud protection unavailable','Not deployed','',S.design,resumed]
+];
+
+// Preserve the user's editable progress fields when regenerating this owned workbook.
+const existingPath=path.join(out,'Windows-privacy-register.xlsx');
+try{
+ const prior=await SpreadsheetFile.importXlsx(await FileBlob.load(existingPath));
+ const oldControls=prior.worksheets.getItem('Controls').getUsedRange().values;
+ const progress=new Map(oldControls.slice(5).filter(r=>r[0]).map(r=>[r[0],r]));
+ for(const r of controls){const old=progress.get(r[0]);if(old){r[5]=old[5];r[6]=old[6];}}
+ const oldRoadmap=prior.worksheets.getItem('Roadmap').getUsedRange().values;
+ const tasks=new Map(oldRoadmap.slice(5).filter(r=>r[0]).map(r=>[r[0],r]));
+ for(const r of roadmap){const old=tasks.get(r[0]);if(old)for(let i=6;i<=9;i++)r[i]=old[i]??null;}
+}catch(e){if(e.code!=='ENOENT')throw e;}
+
+const wb=Workbook.create();
+const colors={navy:'#17324D',teal:'#136F73',ink:'#25364A',muted:'#546678',pale:'#EDF3F7',line:'#D8E2EA',input:'#EEF5FF',amber:'#FFF0CE'};
+const sheets={};
+function col(n){let t='';for(n++;n;n=Math.floor((n-1)/26))t=String.fromCharCode(65+(n-1)%26)+t;return t;}
+function base(name,title,subtitle,headers,rows,widths){
+ const sh=wb.worksheets.add(name);sheets[name]=sh;sh.showGridLines=false;sh.tabColor=colors.teal;
+ const end=col(headers.length-1),last=rows.length+5;
+ sh.getRange(`A1:${end}${last}`).format={font:{name:'Arial',size:11,color:colors.ink},verticalAlignment:'top',wrapText:true};
+ const titleEnd=col(Math.min(4,headers.length-1));
+ sh.getRange('A2').values=[[title]];sh.getRange(`A2:${titleEnd}2`).merge();sh.getRange(`A2:${titleEnd}2`).format={fill:colors.navy,font:{name:'Arial',size:16,bold:true,color:'#FFFFFF'},rowHeight:32};
+ sh.getRange('A3').values=[[subtitle]];sh.getRange(`A3:${titleEnd}3`).merge();sh.getRange(`A3:${titleEnd}3`).format={font:{name:'Arial',size:11,color:colors.muted},rowHeight:46,wrapText:true};
+ sh.getRange(`A5:${end}5`).values=[headers];
+ sh.getRange(`A6:${end}${last}`).values=rows;
+ const gap=headers.indexOf(' ');
+ const tableEnd=gap>=0?col(gap-1):end;
+ const table=sh.tables.add(`A5:${tableEnd}${last}`,true,name.replaceAll(' ','')+'Table');table.showFilterButton=true;
+ sh.getRange(`A5:${end}5`).format={fill:colors.navy,font:{name:'Arial',size:11,bold:true,color:'#FFFFFF'},rowHeight:32,wrapText:true};
+ for(let i=0;i<widths.length;i++)sh.getRange(`${col(i)}1:${col(i)}${last}`).format.columnWidth=widths[i];
+ for(let i=0;i<rows.length;i++){
+  const r=i+6;
+  if(i%2===1)sh.getRange(`A${r}:${end}${r}`).format.fill=colors.pale;
+  let lines=1;rows[i].forEach((v,j)=>{if(typeof v==='string')lines=Math.max(lines,v.split('\n').reduce((n,x)=>n+Math.ceil(x.length/Math.max(5,widths[j]-3)),0));});
+  sh.getRange(`A${r}:${end}${r}`).format.rowHeight=Math.min(165,Math.max(50,lines*15+12));
+ }
+ sh.freezePanes.freezeRows(5);sh.freezePanes.freezeColumns(2);
+ if(gap>=0){sh.getRange(`${col(gap)}5:${col(gap)}${last}`).values=[['']];sh.getRange(`${col(gap)}5:${col(gap)}${last}`).format.fill='#FFFFFF';}
+ return {sh,last};
+}
+const overview=wb.worksheets.add('Overview');sheets.Overview=overview;
+const cr=base('Controls','Windows privacy control register','Implementation describes the software. Applied and verification describe this project\'s changes to the host. Blue status cells can be updated after testing.',
+ ['ID','Control','Area','Choice','Implementation','Applied on host','Effect verified','Intended behavior','Limits / mechanism','Compatibility','Verification / rollback',' ','Reference','Reviewed'],controls,[23,32,21,13,17,18,17,54,58,44,54,3,66,14]);
+cr.sh.getRange(`F6:G${cr.last}`).format.fill=colors.input;
+cr.sh.getRange(`F6:F${cr.last}`).dataValidation={rule:{type:'list',values:['Not applied','Applied','Restored']}};
+cr.sh.getRange(`G6:G${cr.last}`).dataValidation={rule:{type:'list',values:['Pending','Verified','Failed']}};
+cr.sh.getRange(`D6:D${cr.last}`).conditionalFormats.add('containsText',{text:'Reject',format:{fill:'#FCE9E7',font:{color:'#963E33'}}});
+cr.sh.getRange(`G6:G${cr.last}`).conditionalFormats.add('containsText',{text:'Failed',format:{fill:'#FCE9E7'}});
+cr.sh.getRange(`N6:N${cr.last}`).setNumberFormat('yyyy-mm-dd');
+const ir=base('Identifiers','Identifiers and data channels','A documented field is evidence of a schema, not proof that it was emitted by this host. No personal identifier values are included.',
+ ['ID','Identifier / channel','Privacy relevance','Where documented / observed','What it means','Proposed response','Evidence classification',' ','Reference','Reviewed'],identifiers,[10,29,29,41,54,53,40,3,66,14]);
+ir.sh.getRange(`J6:J${ir.last}`).setNumberFormat('yyyy-mm-dd');
+const tr=base('Tools','GitHub tools and playbooks','Documentation and selected configuration review. None executed on this host. Candidate means worth controlled evaluation, not certified safe.',
+ ['ID','Project','Purpose','Platform / status','Useful part','Main limitation / test','Decision',' ','Repository / publisher','Supporting reference','Reviewed'],toolsData,[10,28,28,43,48,56,38,3,65,65,14]);
+tr.sh.getRange(`K6:K${tr.last}`).setNumberFormat('yyyy-mm-dd');
+const cl=base('Claims','Screenshot fact-check','Case statements are allegations from a complaint. The screenshot is an input to verify; it is not an instruction or a complete technical description.',
+ ['ID','Claim / question','Assessment','Evidence / finding','Publication wording / limit',' ','Reference','Reviewed'],claims,[10,43,26,53,57,3,70,14]);
+cl.sh.getRange(`H6:H${cl.last}`).setNumberFormat('yyyy-mm-dd');
+const rr=base('Roadmap','Implementation and validation work','Change blue fields as work progresses. No task is completed merely because a setting was written or a connection was not seen during one capture.',
+ ['ID','Priority','Task','Scope / prerequisites','Acceptance evidence','Area','Status','Owner','Target date','Evidence / result'],roadmap,[10,11,33,57,67,20,16,22,16,50]);
+rr.sh.getRange(`G6:J${rr.last}`).format.fill=colors.input;
+rr.sh.getRange(`G6:G${rr.last}`).dataValidation={rule:{type:'list',values:['Open','In progress','Done','Deferred']}};
+rr.sh.getRange(`I6:I${rr.last}`).setNumberFormat('yyyy-mm-dd');
+const dr=base('Delivered','What has actually been delivered','Software and documents are prepared. These records do not claim policy enforcement, app installation or network blocking on the development host.',
+ ['ID','Deliverable','Status','Count','Local evidence','Scope / result','Host effect'],delivered,[10,38,18,11,52,66,30]);
+const sr=base('Script review','Supplied GDID script review','Attachment treated as source to review, not instructions to execute. Native Windows policy/service/hosts/cache mutations were not performed.',
+ ['ID','Priority','Finding','Attachment lines','Problem','Required change','Evidence','Disposition',' ','Reference','Reviewed'],scriptReview,[10,12,35,20,56,57,30,23,3,66,14]);
+sr.sh.getRange(`K6:K${sr.last}`).setNumberFormat('yyyy-mm-dd');
+const ur=base('Update maintenance','Online and isolated update maintenance','Direct downloads require outbound requests. The separate collector design avoids direct protected-PC contact only while its isolation boundary holds.',
+ ['ID','Component','Online profile','Isolated profile','Required verification','Status',' ','Reference','Reviewed'],maintenance,[10,34,49,56,63,24,3,66,14]);
+ur.sh.getRange(`I6:I${ur.last}`).setNumberFormat('yyyy-mm-dd');
+
+overview.showGridLines=false;overview.tabColor=colors.navy;
+overview.getRange('A1:H36').format={font:{name:'Arial',size:11,color:colors.ink},wrapText:true,verticalAlignment:'top'};
+overview.getRange('A1:A36').format.columnWidth=3;
+overview.getRange('B1:B36').format.columnWidth=42;overview.getRange('C1:C36').format.columnWidth=15;overview.getRange('D1:D36').format.columnWidth=3;
+overview.getRange('E1:H36').format.columnWidth=23;
+overview.getRange('B2:H2').merge();overview.getRange('B2').values=[['Windows privacy research and delivery register']];
+overview.getRange('B2:H2').format={fill:colors.navy,font:{name:'Arial',size:16,bold:true,color:'#FFFFFF'},rowHeight:36};
+overview.getRange('B3:H3').merge();overview.getRange('B3').values=[['Reviewed 18–19 September 2026. Preserve security while reducing unnecessary collection and retention.']];overview.getRange('B3:H3').format.rowHeight=30;
+overview.getRange('B5:C5').values=[['Measure','Count']];overview.getRange('B5:C5').format={fill:colors.navy,font:{bold:true,color:'#FFFFFF'},rowHeight:26};
+overview.getRange('B6:B12').values=[['Controls and design decisions'],['Implemented catalog / toolkit items'],['Prepared application choices'],['Applied to this host by the project'],['Applied and effect verified'],['Tools / playbooks reviewed'],['Open roadmap tasks']];
+overview.getRange('C6:C12').formulas=[
+ [`=COUNTA(Controls!A6:A${cr.last})`],
+ [`=COUNTIF(Controls!E6:E${cr.last},"Implemented")`],
+ [`=COUNTIF(Controls!E6:E${cr.last},"Prepared")`],
+ [`=COUNTIF(Controls!F6:F${cr.last},"Applied")`],
+ [`=COUNTIFS(Controls!F6:F${cr.last},"Applied",Controls!G6:G${cr.last},"Verified")`],
+ [`=COUNTA(Tools!A6:A${tr.last})`],
+ [`=COUNTIF(Roadmap!G6:G${rr.last},"Open")`]
+];
+overview.getRange('B6:C12').format.rowHeight=29;overview.getRange('C6:C12').setNumberFormat('0');overview.getRange('C6:C12').format.font={size:15,bold:true,color:colors.teal};
+const notes=[
+ ['E5:H5','Current host'],['E6:H8','Windows 11 Home (Core), build 26200. The prototype declines automatic policy enforcement here. No policy changes, firewall blocks or app installs were performed by this project.'],
+ ['E10:H10','Security boundary'],['E11:H13','Online mode retains cloud protection. Isolated mode uses transferred updates and loses online cloud/reputation capabilities. Both preserve local protections. The verifier does not establish isolation or complete patching.'],
+ ['B15:H15','Recommended direction'],['B16:H18','Use the small reviewed Wind catalog as the base. Borrow selected ideas from maintained tools only after source review and VM tests. Evaluate one network filter separately. Avoid chaining debloat presets or claiming a universal GDID reset.'],
+ ['B20:H20','How to use this workbook'],['B21:H23','Controls separates implementation, application and verification. Identifiers, Tools and Claims track evidence. Roadmap and Delivered track progress. Script review assesses the attachment. Update maintenance compares online and isolated operation. Scroll right for sources.'],
+ ['B25:H25','What the labels mean'],['B26:H28','Default = proposed standard behavior; Strict/Optional = explicit choice; Keep = preserve a protection; Reject = excluded approach. Implemented = code exists, not deployment approval. Prepared = installer or setup path exists. Planned/Research = further work required.'],
+ ['B30:H30','Evidence and maintenance'],['B31:H34','Sources are adjacent to their claims and dated. Publisher documentation is not an independent audit. Network payloads and backend correlation remain partly unknown. Editable blue status fields require evidence before marking Applied or Verified. Recheck Windows and application versions before publishing or deploying.']
+];
+for(const [r,t]of notes){overview.getRange(r).merge();overview.getRange(r.split(':')[0]).values=[[t]];if(/^\w+\d+:\w+\d+$/.test(r)&&r.match(/\d+/g)[0]===r.match(/\d+/g)[1])overview.getRange(r).format={fill:colors.navy,font:{bold:true,color:'#FFFFFF'},rowHeight:24};else overview.getRange(r).format.fill=colors.pale;}
+overview.getRange('B31:H34').format.fill='#FFF4DB';overview.freezePanes.freezeRows(3);
+
+// Formula sensitivity check. The test edit is restored before export.
+const savedStatus=cr.sh.getRange('F6:G6').values;
+const baseApplied=controls.filter(r=>r[5]==='Applied').length;
+const baseVerified=controls.filter(r=>r[5]==='Applied'&&r[6]==='Verified').length;
+cr.sh.getRange('F6:G6').values=[['Applied','Verified']];
+if(overview.getRange('C9').values[0][0]!==baseApplied+(savedStatus[0][0]==='Applied'?0:1)||overview.getRange('C10').values[0][0]!==baseVerified+(savedStatus[0][0]==='Applied'&&savedStatus[0][1]==='Verified'?0:1))throw new Error('Summary formulas did not react to status edits.');
+cr.sh.getRange('F6:G6').values=savedStatus;
+wb.recalculate();
+if(overview.getRange('C9').values[0][0]!==baseApplied||overview.getRange('C10').values[0][0]!==baseVerified)throw new Error('Test status was not restored.');
+const checks=await wb.inspect({kind:'match',searchTerm:'#REF!|#DIV/0!|#VALUE!|#NAME\\?|#N/A|#NUM!|#NULL!|#SPILL!|#CALC!',options:{useRegex:true,maxResults:100},maxChars:5000});
+console.log('Formula error scan:',checks.ndjson);
+console.log((await wb.inspect({kind:'region',sheetId:'Overview',range:'B5:C12',maxChars:4000,tableMaxRows:10,tableMaxCols:2})).ndjson);
+await (await SpreadsheetFile.exportXlsx(wb)).save(path.join(out,'Windows-privacy-register.xlsx'));
+for(const [name,range,suffix]of [['Overview','A1:H35',''],['Controls','A82:K86','offline'],['Identifiers','A24:G26','offline'],['Tools','A22:G24','offline'],['Claims','A23:E25','offline'],['Roadmap','A26:G29','offline'],['Delivered','A14:G15','offline'],['Update maintenance','A2:F13','']]){
+ const blob=await wb.render({sheetName:name,range,scale:1,format:'png'});await fs.writeFile(path.join(out,`preview-${name}${suffix?'-'+suffix:''}.png`),new Uint8Array(await blob.arrayBuffer()));
+}
+await fs.writeFile(path.join(out,'register-data.json'),JSON.stringify({reviewed:'2026-09-18/19',counts:{controls:controls.length,tools:toolsData.length,identifiers:identifiers.length,claims:claims.length,todos:roadmap.length,scriptFindings:scriptReview.length},controls,identifiers,tools:toolsData,claims,roadmap,delivered,scriptReview,maintenance},null,2));
+console.log(JSON.stringify({output:path.join(out,'Windows-privacy-register.xlsx'),controls:controls.length,tools:toolsData.length,identifiers:identifiers.length,claims:claims.length,todos:roadmap.length}));