What an exclusion is
Defender path exclusions (Add-MpPreference -ExclusionPath, admin scope) remove real-time scanning from a directory tree. It's a legitimate enterprise knob for known-good high-churn workloads (build servers, VM storage) with strict provenance control.
Why “optimizer said so” breaks that model
- The churn argument is false. User-profile temp files aren't Defender-hotspots; Windows' real-time scanner doesn't lock those paths any hot-loop anyway.
- Exclusion is scope-forever. Excluding
C:\,Downloads, or the entire profile because “the app is safe” converts the install into a free-cargo lane for whatever follows it — including things that aren't the tool. - Admin for tuning is a smell squared. Exclusions require elevation; a per-user tuner does neither the scan fixing nor the exclude granting.
The cleaner rule
Tools that are fast without exclusions were built so — bounded scans, sequential I/O, memory maps, incremental enumeration. An exclusion ask is announcing the shortcut. ProofTune never asks for AV exclusion: its scopes make Defender happy as-is.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.