I uploaded log file for Kerish doctor maintenance and fix actions, and it said this.
**Summary of risky behaviors observed**
* Aggressive deletion of user Temp folders while installers/OS setup may be running.
* Repeated process-priority changes for system/installer processes (e.g., `setuphost.exe`, `dismhost.exe`, browsers), including toggling between high/low/initial.
* Registry values deleted in AppCompat/installer/uninstall areas without backup.
* Interactions with `C:\$WINDOWS.~BT` and setup-related processes (risk of interfering with upgrading or updates in-progress).
* Memory-optimization failures reported intermittently — suggests conflicts or insufficient checks.
* Background defragmentation activity observed — must be SSD-aware to avoid unnecessary wear.
**Immediate ask**
Please implement fail-safes so the product **does not**:
* Delete temp files that are in use or were modified recently (e.g., configurable threshold (default 24 hours) — avoid deleting very recent files.
* Skip known temp paths used by installers: `%TEMP%\MSI*`, `%TEMP%\setup*`, files with `.tmp` that are currently locked.
* Option: perform a trial safe-delete (move to quarantine folder first) and only purge after 48 hours.
**Pseudocode:**
```pseudo
for file in temp_files:
if file.last_modified < now - 24h and not is_file_locked(file):
safe_delete(file)
else:
skip
```
### 3) Registry modifications must be reversible and whitelisted (HIGH)
* Export any key/value before deletion: `reg export` or programmatic backup.
* Provide a default safe whitelist of registry paths NOT to touch:
* `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*`
* `HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\*`
* `HKLM\SYSTEM\CurrentControlSet\Services\*`
* Provide an option for admins to enable auto restore on failure or to prompt user.
**Example:**
```powershell
reg export "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" "%TEMP%\appcompat-backup.reg"
# then safe-delete or skip if above whitelist
```
### 4) Priority change throttling & safe-lists (MEDIUM)
* Do not change priority of processes on a deny list: installer/update processes, system services, browsers during updates.
* Add rate limit: do not toggle priority for the same PID more than N times in M minutes.
* Prefer setting I/O/CPU niceness rather than high-priority classes for user apps.
**Pseudocode:**
```pseudo
deny_list = ["setuphost.exe", "dismhost.exe", "trustedinstaller.exe", "TiWorker.exe"]
if process.name in deny_list:
skip_priority_change
if process.priority_change_count(pid) > 3 in last 10 minutes:
skip
```
### 5) SSD vs HDD detection for defrag (MEDIUM)
* Use Get-PhysicalDisk/IOCTL or `Get-PhysicalDisk` PowerShell to detect MediaType. If SSD, call Windows Optimize (TRIM) rather than full defrag.
* Add UI info and an override for advanced users.
**PowerShell example:**
```powershell
Get-PhysicalDisk | Format-Table DeviceId, MediaType
# If MediaType == SSD -> use Optimize-Volume -DriveLetter C -ReTrim -AdoptTrim
```
### 6) Memory optimization error handling & diagnostics (LOW → MEDIUM)
* Catch failures and log detailed context (callstack, which driver modules were loaded, permission context).
* Avoid aggressive forced memory trimming when fails; back off and retry later.
* If repeated failures occur, flag the system for deeper diagnostics (suggest memtest).
### 7) Safety toggles for users & automatic restore options (MEDIUM)
* Add a "Safe Mode" or "Protect critical operations" toggle:
* Pause scheduled cleanups during typical update windows.
* Create System Restore point before large registry changes: `Checkpoint-Computer -Description "Kerish pre-reg fix"`.
* Offer “Quarantine-first” deletion: move items to a recoverable folder for N days.
## C. Testing & QA recommendations
* Build scenarios and automated tests:
* Windows Update in progress (simulate `TiWorker` + \$WINDOWS.\~BT) + run cleanup. Ensure cleanup defers.
* Install large MSI that writes to %TEMP% while cleanup runs.
* SSD/HDD detection tests across a matrix of brands/controllers.
* Registry delete/restore test (backup and restore verify).
* Add telemetry to log: file path, action, pre-check results, whether file was locked, process IDs involved, timestamps (for easier debugging of user reports).
## D. Rollout recommendation & urgency
* **Hotfix (urgent):** Add immediate checks to detect Windows Update/setup and short-circuit destructive operations. (High priority — reduces risk of bricking/updating errors.)
* **Follow-ups:** Implement whitelist, registry backup/undo, and SSD-aware defrag in next minor release. (Medium priority)
---
# 3) Priority table (suggested)
| Fix | Severity | ETA suggestion |
| ------------------------------------------------------------------ | ---------: | -------------: |
| Detect Windows Update/setup in progress & abort aggressive cleanup | High | Hotfix (days) |
| Registry backup + whitelist + optional restore | High | 1-2 sprints |
| Safer temp deletion (age + lock checks + quarantine) | High | 1 sprint |
| SSD detection for defrag | Medium | 1 sprint |
| Priority-change throttling and deny list | Medium | 1 sprint |
| Memory opt error handling & diagnostics | Low→Medium | 1-2 sprints |
**Summary of risky behaviors observed**
* Aggressive deletion of user Temp folders while installers/OS setup may be running.
* Repeated process-priority changes for system/installer processes (e.g., `setuphost.exe`, `dismhost.exe`, browsers), including toggling between high/low/initial.
* Registry values deleted in AppCompat/installer/uninstall areas without backup.
* Interactions with `C:\$WINDOWS.~BT` and setup-related processes (risk of interfering with upgrading or updates in-progress).
* Memory-optimization failures reported intermittently — suggests conflicts or insufficient checks.
* Background defragmentation activity observed — must be SSD-aware to avoid unnecessary wear.
**Immediate ask**
Please implement fail-safes so the product **does not**:
* Delete temp files that are in use or were modified recently (e.g., configurable threshold (default 24 hours) — avoid deleting very recent files.
* Skip known temp paths used by installers: `%TEMP%\MSI*`, `%TEMP%\setup*`, files with `.tmp` that are currently locked.
* Option: perform a trial safe-delete (move to quarantine folder first) and only purge after 48 hours.
**Pseudocode:**
```pseudo
for file in temp_files:
if file.last_modified < now - 24h and not is_file_locked(file):
safe_delete(file)
else:
skip
```
### 3) Registry modifications must be reversible and whitelisted (HIGH)
* Export any key/value before deletion: `reg export` or programmatic backup.
* Provide a default safe whitelist of registry paths NOT to touch:
* `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*`
* `HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\*`
* `HKLM\SYSTEM\CurrentControlSet\Services\*`
* Provide an option for admins to enable auto restore on failure or to prompt user.
**Example:**
```powershell
reg export "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" "%TEMP%\appcompat-backup.reg"
# then safe-delete or skip if above whitelist
```
### 4) Priority change throttling & safe-lists (MEDIUM)
* Do not change priority of processes on a deny list: installer/update processes, system services, browsers during updates.
* Add rate limit: do not toggle priority for the same PID more than N times in M minutes.
* Prefer setting I/O/CPU niceness rather than high-priority classes for user apps.
**Pseudocode:**
```pseudo
deny_list = ["setuphost.exe", "dismhost.exe", "trustedinstaller.exe", "TiWorker.exe"]
if process.name in deny_list:
skip_priority_change
if process.priority_change_count(pid) > 3 in last 10 minutes:
skip
```
### 5) SSD vs HDD detection for defrag (MEDIUM)
* Use Get-PhysicalDisk/IOCTL or `Get-PhysicalDisk` PowerShell to detect MediaType. If SSD, call Windows Optimize (TRIM) rather than full defrag.
* Add UI info and an override for advanced users.
**PowerShell example:**
```powershell
Get-PhysicalDisk | Format-Table DeviceId, MediaType
# If MediaType == SSD -> use Optimize-Volume -DriveLetter C -ReTrim -AdoptTrim
```
### 6) Memory optimization error handling & diagnostics (LOW → MEDIUM)
* Catch failures and log detailed context (callstack, which driver modules were loaded, permission context).
* Avoid aggressive forced memory trimming when fails; back off and retry later.
* If repeated failures occur, flag the system for deeper diagnostics (suggest memtest).
### 7) Safety toggles for users & automatic restore options (MEDIUM)
* Add a "Safe Mode" or "Protect critical operations" toggle:
* Pause scheduled cleanups during typical update windows.
* Create System Restore point before large registry changes: `Checkpoint-Computer -Description "Kerish pre-reg fix"`.
* Offer “Quarantine-first” deletion: move items to a recoverable folder for N days.
## C. Testing & QA recommendations
* Build scenarios and automated tests:
* Windows Update in progress (simulate `TiWorker` + \$WINDOWS.\~BT) + run cleanup. Ensure cleanup defers.
* Install large MSI that writes to %TEMP% while cleanup runs.
* SSD/HDD detection tests across a matrix of brands/controllers.
* Registry delete/restore test (backup and restore verify).
* Add telemetry to log: file path, action, pre-check results, whether file was locked, process IDs involved, timestamps (for easier debugging of user reports).
## D. Rollout recommendation & urgency
* **Hotfix (urgent):** Add immediate checks to detect Windows Update/setup and short-circuit destructive operations. (High priority — reduces risk of bricking/updating errors.)
* **Follow-ups:** Implement whitelist, registry backup/undo, and SSD-aware defrag in next minor release. (Medium priority)
---
# 3) Priority table (suggested)
| Fix | Severity | ETA suggestion |
| ------------------------------------------------------------------ | ---------: | -------------: |
| Detect Windows Update/setup in progress & abort aggressive cleanup | High | Hotfix (days) |
| Registry backup + whitelist + optional restore | High | 1-2 sprints |
| Safer temp deletion (age + lock checks + quarantine) | High | 1 sprint |
| SSD detection for defrag | Medium | 1 sprint |
| Priority-change throttling and deny list | Medium | 1 sprint |
| Memory opt error handling & diagnostics | Low→Medium | 1-2 sprints |
