diff --git a/docs/architecture/current.md b/docs/architecture/current.md index f1f5c8b..79aee2e 100644 --- a/docs/architecture/current.md +++ b/docs/architecture/current.md @@ -173,13 +173,14 @@ Start-GodBrain. Never logout, `--reset`, or uninstall Tailscale. Start/Heal skip the mouth while CS2 is running or has been gone under 10 minutes. `godbrain_core/reclaim11/` is a WPF kit (Reclaim11), not Heal and not -Galaxy. Pack A = Defender / PPL / Sense / AppID. Prep media is a WinPE ISO -(`scripts\New-Reclaim11WinPeIso.ps1`, ADK 10.1.26100.2454) that **deletes** -named catalog `.sys` (never a usermode EXE over a driver, never `Wd*.sys`). -`WdBoot` is refused when Secure Boot is on or n/a. GUI Safe cleanse is -move-only (`restore.json`). Killing blows (IFEO + `sc delete` pack A) require -that receipt and **refuse IoTEnterpriseS**. Never BFE / `mpssvc` / `FltMgr`. -VMware ISO before a physical USB. Check: `scripts\Test-Reclaim11.ps1`. +Galaxy. Pack A = Defender / PPL / Sense / AppID. `WdBoot` stub is refused +when Secure Boot is on. Prep media is a WinPE ISO (`scripts\New-Reclaim11WinPeIso.ps1`, +ADK 10.1.26100.2454) that **parks** catalog `.sys` (does not copy a +usermode EXE over a driver), stubs usermode images, and writes +`Windows\reclaim11-winpe.log` plus `C:\reclaim11\`. Killing blows (IFEO + +`sc delete` pack A) require that receipt. +Never BFE / `mpssvc` / `FltMgr`. VMware ISO before a +physical USB. Check: `scripts\Test-Reclaim11.ps1` on a VM. ## Also in the tree, not the Jarvis path diff --git a/godbrain_core/reclaim11/README.md b/godbrain_core/reclaim11/README.md index d1f9d43..3cb2c6e 100644 --- a/godbrain_core/reclaim11/README.md +++ b/godbrain_core/reclaim11/README.md @@ -117,14 +117,16 @@ Rx/Tx **256–512**. Skips VMware host VMnet / Tailscale / Wi-Fi. `hypervisorlaunchtype Auto`, `vsmlaunchtype Off`, `sos No`, `useplatformclock No`, `useplatformtick No`, `disabledynamictick Yes`; `{bootmgr}` `bootmenupolicy Legacy`. HKLM -`GlobalTimerResolutionRequests=1`, `SystemResponsiveness=0`, +`GlobalTimerResolutionRequests=1`, `SystemResponsiveness=10`, `Win32PrioritySeparation=38`. On the **active** plan (and High Performance if it exists): USB selective suspend Off, USB 3 link -power Off, PCIe ASPM Off. Does **not** switch the plan, does **not** -set min processor 100%, does **not** disable C-states. AGGRO -(`61329e62`) and Ultimate (`e9a42b02`) refused — those were the -+idle-heat cooks. High Performance as a 24/7 plan stays out -(Start-CS2). `restore.json` first. Desk (IoTEnterpriseS) refused. +power Off, PCIe ASPM Off. The GUI **asks** before switching the +active plan to High Performance (Yes = `/setactive` that GUID; +No = bake HP settings but keep the current plan). CLI needs +`-SwitchHighPerformance`. Does **not** set min processor 100%, +does **not** disable C-states. AGGRO (`61329e62`) and Ultimate +(`e9a42b02`) refused — those were the +idle-heat cooks. +`restore.json` first. WinPE MiniNT refused (that would be the PE BCD). `pwsh -File latency_bake.ps1 -T`. Restore: `pwsh -File latency_bake.ps1 -Restore restore.json`. @@ -135,6 +137,8 @@ SYSTEM and skips that hop. ### From this repo +Run `Test-Reclaim11.ps1` on a VM. Not physical hardware. + ```text godbrain_core\reclaim11\Reclaim11.cmd pwsh -NoProfile -File godbrain_core\reclaim11\ps1\Reclaim11.ps1 -T diff --git a/godbrain_core/reclaim11/brave-policy/README.md b/godbrain_core/reclaim11/brave-policy/README.md index e52e23e..acb67f6 100644 --- a/godbrain_core/reclaim11/brave-policy/README.md +++ b/godbrain_core/reclaim11/brave-policy/README.md @@ -17,7 +17,7 @@ Rewards, Wallet, VPN, Talk, News, Leo, P3A, metrics, Tor, stats ping: **off**. Home button off (`ShowHomeButton=0`). Safe Browsing stays on. Download warnings stay on. -Shields (GPO, from the desk profile — not a 40-click Settings tour): +Shields (GPO, curated Shields, not a 40-click Settings tour): | Setting | Value | |---|---| diff --git a/godbrain_core/reclaim11/brave-policy/SOURCE.txt b/godbrain_core/reclaim11/brave-policy/SOURCE.txt index dd2187a..83a2e00 100644 --- a/godbrain_core/reclaim11/brave-policy/SOURCE.txt +++ b/godbrain_core/reclaim11/brave-policy/SOURCE.txt @@ -9,5 +9,5 @@ Fetched 2026-09-02: windows/examples/brave.reg (ALL policies with SAMPLE values — do not import whole) Home: Brave documents registry because gpedit is not on Home. -Reclaim11 lockdown.reg is a curated subset (bloat + desk Shields), HKLM+HKCU. +Reclaim11 lockdown.reg is a curated subset (bloat + Shields), HKLM+HKCU. Local cache (outside git): C:\nvme\godbrain-hf-raw\brave-policy-templates\ diff --git a/godbrain_core/reclaim11/brave-policy/lockdown.reg b/godbrain_core/reclaim11/brave-policy/lockdown.reg index 48361f4..02c629c 100644 --- a/godbrain_core/reclaim11/brave-policy/lockdown.reg +++ b/godbrain_core/reclaim11/brave-policy/lockdown.reg @@ -22,7 +22,7 @@ Windows Registry Editor Version 5.00 "BravePlaylistEnabled"=dword:00000000 "ShowHomeButton"=dword:00000000 -; Shields defaults from the operator's current Brave (desk). Aggressive +; Shields defaults from a curated Brave profile. Aggressive ; vs Standard adblock is not in ADMX; BlockAds is the GPO equivalent. "DefaultBraveAdblockSetting"=dword:00000002 "DefaultBraveHttpsUpgradeSetting"=dword:00000003 diff --git a/godbrain_core/reclaim11/ps1/Reclaim11.ps1 b/godbrain_core/reclaim11/ps1/Reclaim11.ps1 index ff93de1..56bb4fa 100644 --- a/godbrain_core/reclaim11/ps1/Reclaim11.ps1 +++ b/godbrain_core/reclaim11/ps1/Reclaim11.ps1 @@ -314,9 +314,9 @@ $btnRun.Add_Click({ "Reclaim11") | Out-Null return } - $warn = "Run the ticked actions on THIS Windows. restore.json is written first where it applies. Desk/IoT is refused. Continue?" + $warn = "Run the ticked actions on THIS Windows. restore.json is written first where it applies. Continue?" if ($doReaper) { - $warn = "Send Grim Reaper on THIS Windows. WU/Medic/USO die. Defender trees stub+DACL. After PE. Desk refused. Continue?" + $warn = "Send Grim Reaper on THIS Windows. WU/Medic/USO die. Defender trees stub+DACL. After PE. Continue?" } $q = [System.Windows.MessageBox]::Show( $warn, @@ -367,7 +367,19 @@ $btnRun.Add_Click({ } if ($doLatency) { try { - $plan = Invoke-Reclaim11LatencyBake -Root $here + $switchHp = $false + $hpOffer = Get-Reclaim11LatencyHighPerformanceOffer + if ($hpOffer.listed -and -not $hpOffer.already_active) { + $hpQ = [System.Windows.MessageBox]::Show( + "Recommended: switch the active power plan to High Performance.`n`nUSB selective suspend, USB 3 link power, and PCIe ASPM are written onto High Performance and onto the current plan either way. Switch now?", + "Reclaim11 High Performance", + "YesNo", + "Question") + $switchHp = ($hpQ -eq "Yes") + } elseif (-not $hpOffer.listed) { + Add-Log "High Performance plan not listed; baking the active plan only." + } + $plan = Invoke-Reclaim11LatencyBake -Root $here -SwitchHighPerformance:$switchHp Add-Log ("latency bake applied {0}" -f (@($plan.applied).Count)) Add-Log ("manifest {0}" -f $plan.manifest_path) } catch { @@ -504,7 +516,7 @@ $btnNoobTest.Add_Click({ $btnNoobFix.Add_Click({ if ($script:ProcessRunning) { return } $q = [System.Windows.MessageBox]::Show( - "TEST already listed Xbox + telemetry. This RUNS them on THIS Windows. restore.json first. Not Grim Reaper. Desk/IoT refused. Continue?", + "TEST already listed Xbox + telemetry. This RUNS them on THIS Windows. restore.json first. Not Grim Reaper. Continue?", "Reclaim11 JUST FIX MY SH*T", "YesNo", "Warning") diff --git a/godbrain_core/reclaim11/ps1/grim_reaper.ps1 b/godbrain_core/reclaim11/ps1/grim_reaper.ps1 index c081136..4448468 100644 --- a/godbrain_core/reclaim11/ps1/grim_reaper.ps1 +++ b/godbrain_core/reclaim11/ps1/grim_reaper.ps1 @@ -665,15 +665,6 @@ if ($SelfTest) { return } -function Test-Reclaim11ReaperDeskHost { - # Inline EditionID. Do not dotsource inventory.ps1 (StrictMode/Stop). - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ErrorAction SilentlyContinue - if (-not $n) { return $null } - $prop = $n.PSObject.Properties["EditionID"] - if (-not $prop) { return $null } - [string]$prop.Value -eq "IoTEnterpriseS" -} - function Test-Reclaim11ReaperWinPeReceipt { # Inline JSON id. Do not dotsource inventory.ps1 (StrictMode/Stop). $root = $env:SystemRoot @@ -695,17 +686,10 @@ function Test-Reclaim11ReaperWinPeReceipt { $false } -$desk = Test-Reclaim11ReaperDeskHost $hasReceipt = Test-Reclaim11ReaperWinPeReceipt $wd = Join-Path $env:SystemRoot "System32\drivers\WdFilter.sys" $wdPresent = Test-Path -LiteralPath $wd if (-not $WhatIf) { - if ($null -eq $desk) { - throw "Refuse: cannot read EditionID (needed to refuse desk)" - } - if ($desk) { - throw "Refuse: desk (IoTEnterpriseS). Grim Reaper is VM-only. Not M1ABRAMS." - } if (-not $hasReceipt) { throw "Refuse: no WinPE receipt. Boot the Reclaim11 WinPE ISO first." } @@ -716,7 +700,6 @@ if (-not $WhatIf) { if ($WhatIf) { Write-Host "TEST ONLY (DeviceCleanupCmd -t). mutate=false." -ForegroundColor Yellow - Write-Host (" desk={0} (IoTEnterpriseS would refuse)" -f $desk) Write-Host (" winpe_receipt={0}" -f $hasReceipt) Write-Host (" WdFilter.sys present={0}" -f $wdPresent) Write-Host (" stub={0} exists={1}" -f $StubPath, (Test-PeMz $StubPath)) @@ -739,9 +722,7 @@ if ($WhatIf) { Write-Host " would deltask WindowsUpdate / WaaSMedic / UpdateOrchestrator (named folders)" Write-Host (" would hide WU in Settings ({0}; Game Mode stays)" -f (Merge-WipeHidePages -Current "" -Hide $script:WuHidePages)) Write-Host " would SetDisableUXWUAccess=1 (Check for updates on System)" - if ($null -eq $desk) { Write-Host "WOULD REFUSE cannot read EditionID" -ForegroundColor Red } - elseif ($desk) { Write-Host "WOULD REFUSE desk (IoTEnterpriseS)" -ForegroundColor Red } - elseif (-not $hasReceipt) { Write-Host "WOULD REFUSE no WinPE receipt" -ForegroundColor Red } + if (-not $hasReceipt) { Write-Host "WOULD REFUSE no WinPE receipt" -ForegroundColor Red } elseif ($wdPresent) { Write-Host "WOULD REFUSE WdFilter.sys still present" -ForegroundColor Red } else { Write-Host "WOULD RUN (after WinPE; named .sys delete, never stub kernel)" -ForegroundColor Green } return diff --git a/godbrain_core/reclaim11/ps1/inventory.ps1 b/godbrain_core/reclaim11/ps1/inventory.ps1 index b23e8ce..c1c5862 100644 --- a/godbrain_core/reclaim11/ps1/inventory.ps1 +++ b/godbrain_core/reclaim11/ps1/inventory.ps1 @@ -5,11 +5,6 @@ param() Set-StrictMode -Version Latest $ErrorActionPreference = "Stop" -function Test-Reclaim11DeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - function Get-Reclaim11Root { $start = $PSScriptRoot if ([string]::IsNullOrWhiteSpace($start) -and $MyInvocation.MyCommand.Path) { diff --git a/godbrain_core/reclaim11/ps1/killing_blows.ps1 b/godbrain_core/reclaim11/ps1/killing_blows.ps1 index c34b480..5db1576 100644 --- a/godbrain_core/reclaim11/ps1/killing_blows.ps1 +++ b/godbrain_core/reclaim11/ps1/killing_blows.ps1 @@ -1,5 +1,5 @@ # Pack-A killing blows after a valid WinPE receipt. Never BFE / mpssvc / FltMgr. -# Desk (IoTEnterpriseS) is refused. Not Heal. Not a live wipe of the host. +# Not Heal. Not a live wipe of the running OS without a WinPE receipt. Set-StrictMode -Version Latest $ErrorActionPreference = "Stop" @@ -14,11 +14,6 @@ function Test-Reclaim11Admin { $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } -function Test-Reclaim11DeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - function Test-Reclaim11PackATaskPath { param($Catalog, [string]$Path) $p = ([string]$Path).Replace("/", "\").TrimEnd("\") @@ -87,16 +82,12 @@ function Invoke-Reclaim11KillingBlows { throw "Invoke-Reclaim11KillingBlows: pack A lists never-touch $s" } } - $desk = Test-Reclaim11DeskHost $admin = Test-Reclaim11Admin $receipt = Get-Reclaim11WinPeReceipt $wd = Join-Path $env:SystemRoot "System32\drivers\WdFilter.sys" $wdPresent = Test-Path -LiteralPath $wd $inv = Get-Reclaim11Inventory -Root $Root $stub = Get-Reclaim11KillingStub -Catalog $cat - if ((-not $WhatIf) -and $desk) { - throw "Refuse: desk (IoTEnterpriseS). Killing blows are VM-only. Not M1ABRAMS." - } if (-not $WhatIf) { $el = Resolve-Reclaim11Worker -Name "elevate.ps1" -Root $Root . $el @@ -151,7 +142,6 @@ function Invoke-Reclaim11KillingBlows { if ($WhatIf) { $checks = @( (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "killing blows need TI via admin"), - (New-Reclaim11Check -Name "desk" -Ok (-not $desk) -Detail $(if ($desk) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })), (New-Reclaim11Check -Name "winpe" -Ok ([bool]$receipt) -Detail $(if ($receipt) { [string]$receipt } else { "no reclaim11-winpe.log" })), (New-Reclaim11Check -Name "WdFilter" -Ok (-not $wdPresent) -Detail $(if ($wdPresent) { $wd } else { "parked" })), (New-Reclaim11Check -Name "never_touch" -Ok ([bool]$inv.never_touch_ok) -Detail "BFE/mpssvc RUNNING"), diff --git a/godbrain_core/reclaim11/ps1/latency_bake.ps1 b/godbrain_core/reclaim11/ps1/latency_bake.ps1 index e3b80f1..fade8c1 100644 --- a/godbrain_core/reclaim11/ps1/latency_bake.ps1 +++ b/godbrain_core/reclaim11/ps1/latency_bake.ps1 @@ -1,13 +1,15 @@ -# Expert BCD + timer/MMCSS + USB/ASPM bake. restore.json first. Desk refused. +# Expert BCD + timer/MMCSS + USB/ASPM bake. restore.json first. # Not pack A. Not startnet. Not AGGRO/Ultimate (those kill C-states, +idle heat). -# Not min-processor 100. High Performance switch stays Start-CS2. +# Not min-processor 100. USB/ASPM on active + High Performance if listed. +# GUI asks before /setactive High Performance. CLI needs -SwitchHighPerformance. # nx AlwaysOff is DEP off — Expert only. MiniNT refused (that is the PE BCD). [CmdletBinding()] param( [string]$Restore = "", [Alias("T", "Test")] - [switch]$WhatIf + [switch]$WhatIf, + [switch]$SwitchHighPerformance ) Set-StrictMode -Version Latest @@ -39,7 +41,7 @@ $script:RegBake = @( @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" Name = "SystemResponsiveness" - Wanted = 0 + Wanted = 10 # 0-9 clamp to 20 (stock). 10 is the lowest MMCSS keeps. }, @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl" @@ -74,11 +76,6 @@ $script:PowerAcBake = @( } ) -function Test-Reclaim11LatencyDeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - function Test-Reclaim11LatencyPeHost { Test-Path -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Control\MiniNT" } @@ -184,6 +181,21 @@ function Test-Reclaim11PowerForbiddenGuid { @($script:PowerForbiddenGuid | ForEach-Object { $_.ToLowerInvariant() }) -contains $g } +function Get-Reclaim11LatencyHighPerformanceOffer { + $hp = $script:PowerHighPerfGuid.ToLowerInvariant() + $active = Get-Reclaim11ActivePowerGuid + $listed = @(Get-Reclaim11ListedPowerGuids) + $have = $listed -contains $hp + $activeNorm = if ($active) { $active.ToLowerInvariant() } else { "" } + [pscustomobject]@{ + guid = $hp + listed = [bool]$have + already_active = ($have -and ($activeNorm -eq $hp)) + active = $active + forbidden = Test-Reclaim11PowerForbiddenGuid $active + } +} + function Get-Reclaim11PowerBakeSchemes { param([string]$Active) $listed = @(Get-Reclaim11ListedPowerGuids) @@ -224,17 +236,14 @@ function Write-Reclaim11LatencyManifest { function Invoke-Reclaim11LatencyBake { param( [string]$Root, - [switch]$WhatIf + [switch]$WhatIf, + [switch]$SwitchHighPerformance ) if ([string]::IsNullOrWhiteSpace($Root)) { $Root = $script:Reclaim11Here } $pe = Test-Reclaim11LatencyPeHost - $desk = Test-Reclaim11LatencyDeskHost if ($pe -and -not $WhatIf) { throw "Refuse: WinPE (MiniNT). Latency bake is in-Windows on a VM, not the PE BCD." } - if ($desk -and -not $WhatIf) { - throw "Refuse: desk (IoTEnterpriseS). Latency bake is VM-only. Not M1ABRAMS." - } $admin = $false if (Get-Command Test-Reclaim11Admin -ErrorAction SilentlyContinue) { $admin = Test-Reclaim11Admin @@ -300,16 +309,31 @@ function Invoke-Reclaim11LatencyBake { $would += ("power {0} {1} {2}->{3}" -f $x.scheme, $x.name, $x.before, $x.wanted) } } + $hpOffer = Get-Reclaim11LatencyHighPerformanceOffer + $willSwitchHp = $false + if ($SwitchHighPerformance -and $hpOffer.listed -and -not $hpOffer.already_active -and -not (Test-Reclaim11PowerForbiddenGuid $hpOffer.guid)) { + $willSwitchHp = $true + } + if ($hpOffer.already_active) { + $would += "active already High Performance" + } elseif (-not $hpOffer.listed) { + $would += "High Performance not listed; bake active only" + } else { + $would += "ask High Performance (USB/ASPM baked onto it either way)" + if ($willSwitchHp) { + $would += ("power-active {0}" -f $hpOffer.guid) + } else { + $would += ("keep active {0}" -f $activePower) + } + } $checks = @( (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "bcdedit / HKLM needs admin"), (New-Reclaim11Check -Name "winpe" -Ok (-not $pe) -Detail $(if ($pe) { "MiniNT would refuse (PE BCD)" } else { "not WinPE" })), - (New-Reclaim11Check -Name "desk" -Ok (-not $desk) -Detail $(if ($desk) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })), (New-Reclaim11Check -Name "power" -Ok (-not $powerForbidden) -Detail $(if ($powerForbidden) { "AGGRO/Ultimate idle-disable" } else { "not AGGRO/Ultimate" })) ) $refuse = "" if ($pe) { $refuse = "WinPE (MiniNT)" } - elseif ($desk) { $refuse = "desk (IoTEnterpriseS)" } elseif (-not $admin) { $refuse = "needs elevation" } elseif ($powerForbidden) { $refuse = "AGGRO/Ultimate (processor idle disable)" } @@ -320,8 +344,10 @@ function Invoke-Reclaim11LatencyBake { registry = @($regs) power = @($power) power_active = $activePower + power_high_performance_listed = [bool]$hpOffer.listed + power_switch_high_performance = [bool]$willSwitchHp backup_root = $backupRoot - note = "Restore with pwsh -File latency_bake.ps1 -Restore restore.json. Expert. nx AlwaysOff is DEP off. USB/ASPM on AC, not min-processor 100, not C-state kill." + note = "Restore with pwsh -File latency_bake.ps1 -Restore restore.json. Expert. nx AlwaysOff is DEP off. USB/ASPM on AC, not min-processor 100, not C-state kill. High Performance switch is opt-in." } if ($WhatIf) { @@ -366,12 +392,12 @@ function Invoke-Reclaim11LatencyBake { $failed += ("power:{0}:{1}:{2}" -f $x.scheme, $x.name, $_.Exception.Message) } } - if ($activePower -and -not (Test-Reclaim11PowerForbiddenGuid $activePower)) { + if ($willSwitchHp) { try { - $null = Invoke-Reclaim11PowerCfg -PowerArgs @("/setactive", $activePower) - $applied += ("power-active:{0}" -f $activePower) + $null = Invoke-Reclaim11PowerCfg -PowerArgs @("/setactive", $hpOffer.guid) + $applied += ("power-active:{0}" -f $hpOffer.guid) } catch { - $failed += ("power-active:{0}:{1}" -f $activePower, $_.Exception.Message) + $failed += ("power-active:{0}:{1}" -f $hpOffer.guid, $_.Exception.Message) } } $manifest | Add-Member -NotePropertyName applied -NotePropertyValue $applied @@ -392,9 +418,6 @@ function Restore-Reclaim11LatencyBackup { if (Test-Reclaim11LatencyPeHost) { throw "Refuse: WinPE (MiniNT). Latency restore is in-Windows on a VM, not the PE BCD." } - if (Test-Reclaim11LatencyDeskHost) { - throw "Refuse: desk (IoTEnterpriseS). Latency restore is VM-only. Not M1ABRAMS." - } $restored = @() foreach ($x in @($m.bcd)) { $before = [string]$x.before @@ -445,7 +468,7 @@ if ($MyInvocation.InvocationName -ne ".") { if (-not [string]::IsNullOrWhiteSpace($Restore)) { Restore-Reclaim11LatencyBackup -Manifest $Restore | ConvertTo-Json -Depth 6 } else { - $plan = Invoke-Reclaim11LatencyBake -WhatIf:$WhatIf + $plan = Invoke-Reclaim11LatencyBake -WhatIf:$WhatIf -SwitchHighPerformance:$SwitchHighPerformance if ($WhatIf) { Write-Host (Format-Reclaim11TestReport -Plan $plan -Title "latency_bake") } diff --git a/godbrain_core/reclaim11/ps1/nic_tune.ps1 b/godbrain_core/reclaim11/ps1/nic_tune.ps1 index 60bef9c..cd2a620 100644 --- a/godbrain_core/reclaim11/ps1/nic_tune.ps1 +++ b/godbrain_core/reclaim11/ps1/nic_tune.ps1 @@ -1,7 +1,7 @@ # Gaming NIC tune: disable power-saving / EEE / interrupt moderation, # set RSS on, bump Rx/Tx buffers. Keyword map, not per-vendor scripts. # Physical Ethernet only (skip Wi-Fi, VMware, Tailscale, Bluetooth). -# restore.json first. Desk refused. -T is DeviceCleanupCmd-t. Never BFE. +# restore.json first. -T is DeviceCleanupCmd-t. Never BFE. [CmdletBinding()] param( @@ -51,11 +51,6 @@ $script:NicBufferMin = 256 $script:NicBufferMax = 512 $script:NicBufferWant = 512 -function Test-Reclaim11NicDeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - function Test-Reclaim11NicSkipAdapter { param($Adapter) $desc = [string]$Adapter.InterfaceDescription @@ -222,10 +217,6 @@ function Invoke-Reclaim11NicTune { if ([string]::IsNullOrWhiteSpace($Root)) { $Root = $script:Reclaim11Here } - $desk = Test-Reclaim11NicDeskHost - if ($desk -and -not $WhatIf) { - throw "Refuse: desk (IoTEnterpriseS). NIC tune is VM-only. Not M1ABRAMS." - } $admin = $false if (Get-Command Test-Reclaim11Admin -ErrorAction SilentlyContinue) { $admin = Test-Reclaim11Admin @@ -272,12 +263,10 @@ function Invoke-Reclaim11NicTune { $checks = @( (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "Set-NetAdapterAdvancedProperty needs admin"), - (New-Reclaim11Check -Name "desk" -Ok (-not $desk) -Detail $(if ($desk) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })), (New-Reclaim11Check -Name "ethernet" -Ok ($targets.Count -gt 0) -Detail ("targets={0}" -f $targets.Count)) ) $refuse = "" - if ($desk) { $refuse = "desk (IoTEnterpriseS)" } - elseif (-not $admin) { $refuse = "needs elevation" } + if (-not $admin) { $refuse = "needs elevation" } elseif ($targets.Count -lt 1) { $refuse = "no physical Ethernet" } if ($WhatIf) { @@ -326,9 +315,6 @@ function Restore-Reclaim11NicBackup { if ([string]$m.id -notlike "reclaim11-nic*") { throw "Restore-Reclaim11NicBackup: not a NIC manifest" } - if (Test-Reclaim11NicDeskHost) { - throw "Refuse: desk (IoTEnterpriseS). NIC restore is VM-only. Not M1ABRAMS." - } $restored = @() foreach ($x in @($m.actions)) { $kw = [string]$x.keyword diff --git a/godbrain_core/reclaim11/ps1/noob_cleanse.ps1 b/godbrain_core/reclaim11/ps1/noob_cleanse.ps1 index d863e6a..b857737 100644 --- a/godbrain_core/reclaim11/ps1/noob_cleanse.ps1 +++ b/godbrain_core/reclaim11/ps1/noob_cleanse.ps1 @@ -1,5 +1,5 @@ # Safe cleanse: move pack-A files to a backup catalog + restore.json. Never delete. -# Never BFE / mpssvc / FltMgr. Desk (IoTEnterpriseS) refused when targeting this OS. +# Never BFE / mpssvc / FltMgr. Set-StrictMode -Version Latest $ErrorActionPreference = "Stop" @@ -33,11 +33,6 @@ function Invoke-Reclaim11NoobCleanse { $live = [string]::IsNullOrWhiteSpace($VolumeRoot) if ($live) { $VolumeRoot = $env:SystemDrive } $VolumeRoot = $VolumeRoot.TrimEnd("\") - $sysDrive = $env:SystemDrive.TrimEnd("\") - $deskLive = (Test-Reclaim11DeskHost) -and ($VolumeRoot -eq $sysDrive) - if ($deskLive -and -not $WhatIf) { - throw "Refuse: desk (IoTEnterpriseS). Safe cleanse is VM-only. Not M1ABRAMS." - } foreach ($s in @($cat.never_touch_services)) { if (@($cat.services_pack_a) -contains $s) { throw "Refuse: pack A lists never-touch $s" @@ -117,7 +112,6 @@ function Invoke-Reclaim11NoobCleanse { $manPath = Join-Path $BackupRoot "restore.json" if ($WhatIf) { $checks = @( - (New-Reclaim11Check -Name "desk" -Ok (-not $deskLive) -Detail $(if ($deskLive) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })), (New-Reclaim11Check -Name "WdFilter" -Ok (-not $wdPresent) -Detail $(if ($wdPresent) { $wd } else { "parked or offline volume" })) ) $would = @($items | ForEach-Object { "move {0} -> {1}" -f $_.original, $_.backup }) diff --git a/godbrain_core/reclaim11/ps1/telemetry_cleanse.ps1 b/godbrain_core/reclaim11/ps1/telemetry_cleanse.ps1 index c2bc023..a22c526 100644 --- a/godbrain_core/reclaim11/ps1/telemetry_cleanse.ps1 +++ b/godbrain_core/reclaim11/ps1/telemetry_cleanse.ps1 @@ -1,6 +1,6 @@ # Disable connected-experience telemetry. restore.json first. # DiagTrack + dmwappushservice (from the old autom8ed nuke lists). AllowTelemetry=0. -# Never BFE / mpssvc / FltMgr / EventLog. Desk (IoTEnterpriseS) refused. +# Never BFE / mpssvc / FltMgr / EventLog. # No TI hop (HKCU/admin is enough). No scheduled-task glob. [CmdletBinding()] @@ -22,11 +22,6 @@ $script:TelemetryServices = @( "dmwappushservice" ) -function Test-Reclaim11TelemetryDeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - function Write-Reclaim11TelemetryManifest { param($Manifest, [string]$Path) $dir = Split-Path -Parent $Path @@ -80,11 +75,6 @@ function Invoke-Reclaim11TelemetryCleanse { } } - $desk = Test-Reclaim11TelemetryDeskHost - if ($desk -and -not $WhatIf) { - throw "Refuse: desk (IoTEnterpriseS). Telemetry cleanse is VM-only. Not M1ABRAMS." - } - $allow = Get-Reclaim11TelemetryAllowSnapshot $svcSnap = @() foreach ($name in $script:TelemetryServices) { @@ -120,8 +110,7 @@ function Invoke-Reclaim11TelemetryCleanse { $admin = Test-Reclaim11Admin } $checks = @( - (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "telemetry is admin, not TI"), - (New-Reclaim11Check -Name "desk" -Ok (-not $desk) -Detail $(if ($desk) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })) + (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "telemetry is admin, not TI") ) $would = @("AllowTelemetry=0") foreach ($s in $svcSnap) { @@ -129,8 +118,7 @@ function Invoke-Reclaim11TelemetryCleanse { else { $would += ("skip {0} (absent)" -f $s.name) } } $refuse = "" - if ($desk) { $refuse = "desk (IoTEnterpriseS)" } - elseif (-not $admin) { $refuse = "needs elevation" } + if (-not $admin) { $refuse = "needs elevation" } $manifest | Add-Member -NotePropertyName what_if -NotePropertyValue $true $manifest | Add-Member -NotePropertyName mutate -NotePropertyValue $false $manifest | Add-Member -NotePropertyName checks -NotePropertyValue $checks @@ -178,9 +166,6 @@ function Restore-Reclaim11TelemetryBackup { if ([string]$m.id -notlike "reclaim11-telemetry*") { throw "Restore-Reclaim11TelemetryBackup: not a telemetry manifest" } - if (Test-Reclaim11TelemetryDeskHost) { - throw "Refuse: desk (IoTEnterpriseS). Telemetry restore is VM-only. Not M1ABRAMS." - } $restored = @() $path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" if ($m.allow -and [bool]$m.allow.present) { diff --git a/godbrain_core/reclaim11/ps1/xbox_cleanse.ps1 b/godbrain_core/reclaim11/ps1/xbox_cleanse.ps1 index 2119725..e78760d 100644 --- a/godbrain_core/reclaim11/ps1/xbox_cleanse.ps1 +++ b/godbrain_core/reclaim11/ps1/xbox_cleanse.ps1 @@ -1,7 +1,7 @@ # Hide Xbox Game Bar in Settings, sc-delete Xbox usermode services, # remove the Appx bloat list. Writes restore.json first (Safe-cleanse style). # Game Mode stays. Captures hidden (OBS / ShadowPlay / AMD). Never xboxgip. Never XboxGameCallableUI. -# Never BFE / mpssvc / FltMgr. Desk (IoTEnterpriseS) refused. +# Never BFE / mpssvc / FltMgr. # Provisioned Appx remove is the old script's Store-seed wipe (VM-only). [CmdletBinding()] @@ -90,12 +90,7 @@ function Restart-Reclaim11SettingsApp { } } -function Test-Reclaim11XboxDeskHost { - $n = Get-ItemProperty -LiteralPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" - [string]$n.EditionID -eq "IoTEnterpriseS" -} - -# Old Appx list + remaining Xbox overlays. Not XboxGameCallableUI (desk kept it). +# Old Appx list + remaining Xbox overlays. Not XboxGameCallableUI. $script:XboxAppx = @( "Microsoft.3DBuilder", "Microsoft.XboxGameOverlay", @@ -354,11 +349,7 @@ function Invoke-Reclaim11XboxCleanse { } $appxNames = @(Get-Reclaim11AppxBloatNames -Catalog $cat) if ($appxNames -contains "Microsoft.XboxGameCallableUI") { - throw "Refuse: XboxGameCallableUI stays (desk kept it)" - } - $desk = Test-Reclaim11XboxDeskHost - if ($desk -and -not $WhatIf) { - throw "Refuse: desk (IoTEnterpriseS). Xbox hide is VM-only. Not M1ABRAMS." + throw "Refuse: XboxGameCallableUI stays" } $admin = $false if (Get-Command Test-Reclaim11Admin -ErrorAction SilentlyContinue) { @@ -455,8 +446,7 @@ function Invoke-Reclaim11XboxCleanse { if ($WhatIf) { $checks = @( (New-Reclaim11Check -Name "catalog" -Ok $true -Detail $catPath), - (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "Hide Xbox is admin, not TI"), - (New-Reclaim11Check -Name "desk" -Ok (-not $desk) -Detail $(if ($desk) { "IoTEnterpriseS would refuse" } else { "not desk SKU" })) + (New-Reclaim11Check -Name "admin" -Ok $admin -Detail "Hide Xbox is admin, not TI") ) $would = @() $would += ("HKLM+HKCU SettingsPageVisibility -> {0}" -f $merged) @@ -474,8 +464,7 @@ function Invoke-Reclaim11XboxCleanse { $would += ("Start policy {0}\\{1}={2}" -f $row.path, $row.name, $row.wanted) } $refuse = "" - if ($desk) { $refuse = "desk (IoTEnterpriseS)" } - elseif (-not $admin) { $refuse = "needs elevation" } + if (-not $admin) { $refuse = "needs elevation" } $manifest | Add-Member -NotePropertyName what_if -NotePropertyValue $true $manifest | Add-Member -NotePropertyName mutate -NotePropertyValue $false $manifest | Add-Member -NotePropertyName checks -NotePropertyValue $checks @@ -581,9 +570,6 @@ function Restore-Reclaim11XboxBackup { if ([string]$m.id -notlike "reclaim11-xbox*") { throw "Restore-Reclaim11XboxBackup: not an Xbox/debloat manifest" } - if (Test-Reclaim11XboxDeskHost) { - throw "Refuse: desk (IoTEnterpriseS). Xbox restore is VM-only. Not M1ABRAMS." - } $restored = @() $polLm = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" diff --git a/godbrain_core/reclaim11/winpe/offline.ps1 b/godbrain_core/reclaim11/winpe/offline.ps1 index 81bca53..9973770 100644 --- a/godbrain_core/reclaim11/winpe/offline.ps1 +++ b/godbrain_core/reclaim11/winpe/offline.ps1 @@ -129,7 +129,7 @@ function Get-Reclaim11OfflineEditionId { param([string]$WindowsRoot) $hive = Join-Path $WindowsRoot "System32\config\SOFTWARE" if (-not (Test-Path -LiteralPath $hive)) { - throw "Refuse: cannot read EditionID (needed to refuse desk). missing SOFTWARE hive." + throw "Refuse: cannot read EditionID. missing SOFTWARE hive." } $key = "HKLM\R11EDITION" $null = & reg.exe unload $key 2>&1 @@ -137,16 +137,16 @@ function Get-Reclaim11OfflineEditionId { try { & reg.exe load $key $hive | Out-Null if ($LASTEXITCODE -ne 0) { - throw "Refuse: cannot read EditionID (needed to refuse desk). reg load failed." + throw "Refuse: cannot read EditionID. reg load failed." } $loaded = $true $p = "HKLM:\R11EDITION\Microsoft\Windows NT\CurrentVersion" if (-not (Test-Path -LiteralPath $p)) { - throw "Refuse: cannot read EditionID (needed to refuse desk). missing CurrentVersion." + throw "Refuse: cannot read EditionID. missing CurrentVersion." } $id = [string](Get-ItemProperty -LiteralPath $p).EditionID if ([string]::IsNullOrWhiteSpace($id)) { - throw "Refuse: cannot read EditionID (needed to refuse desk)." + throw "Refuse: cannot read EditionID." } $id } finally { @@ -406,7 +406,7 @@ function Invoke-Reclaim11OfflineApply { $inPe = Test-Reclaim11WinPeSession if ([string]::IsNullOrWhiteSpace($WindowsRoot)) { if (-not $inPe) { - throw "Refuse: this is a full Windows session. Boot the Reclaim11 WinPE ISO (not M1ABRAMS)." + throw "Refuse: this is a full Windows session. Boot the Reclaim11 WinPE ISO." } $vols = @(Find-Reclaim11WindowsVolumes) if ($vols.Count -lt 1) { @@ -427,9 +427,6 @@ function Invoke-Reclaim11OfflineApply { if ([string]::IsNullOrWhiteSpace($sku)) { $sku = Get-Reclaim11OfflineEditionId -WindowsRoot $winResolved } - if ($sku -eq "IoTEnterpriseS") { - throw "Refuse: desk (IoTEnterpriseS). Offline pack A is VM-only. Not M1ABRAMS." - } $volumeRoot = Split-Path -Parent $winResolved if ([string]::IsNullOrWhiteSpace($volumeRoot)) { @@ -518,6 +515,7 @@ function Invoke-Reclaim11OfflineApply { catalog = [string]$cat.id windows_root = $winResolved volume_root = $volumeRoot + edition_id = [string]$sku secure_boot = $sb stub_wdboot = [bool]$allowElam reason_wdboot = $reasonWd diff --git a/scripts/New-Reclaim11WinPeUsb.ps1 b/scripts/New-Reclaim11WinPeUsb.ps1 index c5d7b77..1fec701 100644 --- a/scripts/New-Reclaim11WinPeUsb.ps1 +++ b/scripts/New-Reclaim11WinPeUsb.ps1 @@ -139,7 +139,7 @@ if ($WhatIf -or -not $Go) { } if ($ok.Count -eq 1) { Write-Host ("WOULD format disk {0} ({1}) via MakeWinPEMedia /UFD /F after payload refresh" -f $ok[0].number, $ok[0].name) - Write-Host "Do not boot the stick on this IoT desk." + Write-Host "Do not boot the stick on the PC that built it." } elseif ($ok.Count -lt 1) { Write-Host "WOULD REFUSE no USB stick (need 1GB+, under 32GB, not boot, not C:)" } else { @@ -225,6 +225,6 @@ Copy-Item -LiteralPath $stub -Destination (Join-Path $kitDest "DefenderStub.exe" name = $target.name letter = $destLetter kit = $kitDest - note = "First boot: PE pack-A delete. Reboot. Double-click E:\reclaim11\Reclaim11.cmd (Grim Reaper) in the VM, not this desk." + note = "First boot: PE pack-A delete. Reboot. Double-click E:\reclaim11\Reclaim11.cmd (Grim Reaper) on the target PC." } | ConvertTo-Json -Depth 5 Write-Host "USB ready. Boot in a VM or another PC." diff --git a/scripts/Test-Reclaim11.ps1 b/scripts/Test-Reclaim11.ps1 index 1d17c7f..efaca72 100644 --- a/scripts/Test-Reclaim11.ps1 +++ b/scripts/Test-Reclaim11.ps1 @@ -1,4 +1,5 @@ # Offline + live-read inventory check for Reclaim11. No wipe. Not Heal. +# Run on a VM. Not physical hardware. [CmdletBinding()] param( [string]$RepoRoot = $PSScriptRoot @@ -7,6 +8,22 @@ param( $ErrorActionPreference = "Stop" . (Join-Path $PSScriptRoot "Resolve-GodBrainRoot.ps1") +function Test-Reclaim11IsVirtualMachine { + try { + $cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop + } catch { + return $false + } + $blob = ("{0} {1} {2}" -f [string]$cs.Manufacturer, [string]$cs.Model, [string]$cs.SystemFamily) + if ($blob -match "VMware|VirtualBox|Hyper-V|Virtual Machine|QEMU|KVM|Xen|Parallels|Virtual Platform") { + return $true + } + $false +} +if (-not (Test-Reclaim11IsVirtualMachine)) { + throw "Test-Reclaim11: run on a VM. Not physical hardware." +} + $root = Join-Path $RepoRoot "godbrain_core\reclaim11" $ps1 = Join-Path $root "ps1" $catPath = Join-Path $root "catalog.json" @@ -18,6 +35,20 @@ $cmdPath = Join-Path $root "Reclaim11.cmd" foreach ($p in @($catPath, $xamlPath, $invPath, $launch, $cmdPath)) { if (-not (Test-Path -LiteralPath $p)) { throw "Test-Reclaim11: missing $p" } } +Get-ChildItem -LiteralPath $root -Recurse -File | ForEach-Object { + if ($_.Extension -match '\.(jpg|png|exe|bin)$') { return } + $t = Get-Content -LiteralPath $_.FullName -Raw -Encoding UTF8 -ErrorAction SilentlyContinue + if ([string]::IsNullOrWhiteSpace($t)) { return } + if ($t -match 'M1ABRAMS') { + throw ("Test-Reclaim11: kit must not name a host ({0})" -f $_.FullName) + } + if ($t -match '(?i)(?