Case file: the cleanup that broke Start (and the three rules that prevent every version of it)

The composite story

A bulk-cleaner had a rule “old directories under %LOCALAPPDATA% are safe.” It removed …\Packages\Microsoft.Windows.StartMenuExperienceHost\…\TempState mid-session. Start failed next launch until account re-creation — because the rule didn't check the package owner before aging the folder out.

Rules that close the whole incident class

1. Explicit allowlist of roots: cleanup owns exactly %TEMP%, thumbnail cache, and WER queues — nothing with “Packages” or any other application state parent. Anything outside the list is out of depth, not opportunity.
2. Age filter generous enough to exclude live work: 24 hours minimum; running sessions never stop writing recent files.
3. Never force a locked item: sharing violations report a session temperature — reading “present and locked” as “optional and safe” is the exact heuristic inversion this incident demonstrates.

Deeper dive on the mechanics of the profile-bound cleanup list in the cleanup how-to; the format of a safe failure log (counts of skipped, reasons pinned) appears in the verification post.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.