Clean.me is moving to a scan-first Rust/Tauri model. Scanning is non-destructive. Cleanup execution is limited to items returned by the most recent scan plan and selected by the user.

Safe defaults are intentionally narrow:

• Current user's temporary directory
• old crash dumps
• browser HTTP cache directories
• selected rebuildable system caches

The default catalog does not include:

• browser cookies
• browsing history
• login data
• extension state
• Windows package settings
• Windows Update datastore
• CBS logs
• broad wildcard paths such as C:\Users\*\...

• Paths are checked for wildcards before scan.
• Broad roots such as drive roots, C:\Windows, C:\Users, and Program Files are rejected.
• Cleanup execution accepts only item IDs from the active scan report.
• Each deletion is rechecked against the scanned root before removal.
• Symlinks and junction-like entries are skipped by default.
• Locked or inaccessible files are skipped or reported instead of stopping the whole run.

The migration avoids making the entire UI run with broad administrator rights by default. If future cleanup categories require elevation, they should be implemented as explicit advanced actions or an elevated helper path, not as the baseline app posture.

Before release:

1. Run Rust unit tests.
2. Run frontend build checks.
3. Test cleanup against fixture directories.
4. Test in disposable Windows 10 and Windows 11 VMs.
5. Verify restore point disabled/failing scenarios before any advanced system cleanup is enabled.

Please report vulnerabilities privately. Include a description, reproduction steps, affected version or commit, and potential impact.